CVE-2017-2615

Description

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

How to fix CVE-2017-2615

To remediate CVE-2017-2615, upgrade the affected package to a fixed version below.

—upgrade to 2.8.1-r1 or later
—upgrade to 4.7.1-r5 or later
—upgrade to 1:2.8+dfsg-3 or later
—upgrade to 1.1.2+dfsg-6+deb7u20 or later
—upgrade to 1.1.2+dfsg-6+deb7u20 or later

Is CVE-2017-2615 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

from 0, < 2.8.1-r1
from 0, < 4.7.1-r5
from 0, < 1:2.8+dfsg-3
from 0, < 1.1.2+dfsg-6+deb7u20
from 0, < 1.1.2+dfsg-6+deb7u20

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H