Description
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=501131 ↗
- http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331 ↗
- http://www.openwall.com/lists/oss-security/2009/10/16/8 ↗
- http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5 ↗
- http://marc.info/?l=qemu-devel&m=124324043812915 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=508567 ↗
- http://www.securityfocus.com/bid/36716 ↗
- http://rhn.redhat.com/errata/RHEA-2009-1272.html ↗
- http://www.openwall.com/lists/oss-security/2009/10/16/5 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=505641 ↗