FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

qemu -- several vulnerabilities

Affected packages
qemu < 0.9.0_1
0.9.0s.20070101* <= qemu < 0.9.0s.20070405_3
qemu-devel < 0.9.0_1
0.9.0s.20070101* <= qemu-devel < 0.9.0s.20070405_3

Details

VuXML ID 0ac89b39-f829-11db-b55c-000e0c6d38a9
Discovery 2007-05-01
Entry 2007-05-01
Modified 2007-05-02

The Debian Security Team reports:

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-1320
Tavis Ormandy discovered that a memory management routine of the Cirrus video driver performs insufficient bounds checking, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1321
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1322
Tavis Ormandy discovered that the "icebp" instruction can be abused to terminate the emulation, resulting in denial of service.

CVE-2007-1323
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1366
Tavis Ormandy discovered that the "aam" instruction can be abused to crash qemu through a division by zero, resulting in denial of service.

References

CVE Name CVE-2007-1320
CVE Name CVE-2007-1321
CVE Name CVE-2007-1322
CVE Name CVE-2007-1323
CVE Name CVE-2007-1366
Message 20070501100313.GA4074@galadriel.inutil.org