CVE-2012-0029
xen-qemu-dm-4.0 - buffer overflow
EPSS 1.0%
Description
Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.
How to fix CVE-2012-0029
To remediate CVE-2012-0029, upgrade the affected package to a fixed version below.
- Debian/qemu-kvm—upgrade to 0.12.5+dfsg-5+squeeze8 or later
- Debian/xen—upgrade to 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 or later
- —upgrade to 4.0.1-2+squeeze1 or later
Is CVE-2012-0029 being exploited?
Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 0.12.5+dfsg-5+squeeze8
- from 0, < 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1
- from 0, < 4.0.1-2+squeeze1