CVE-2008-4539

Published: Dec 29, 2008Modified: Apr 23, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.

Affected (6)

Products: Kvm Qumranet: Kvm · Qemu: Qemu · Canonical: Ubuntu Linux · +1 more

Show all products

Kvm Qumranet: Kvm · Qemu: Qemu · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

1 product

Configuration A

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Kvm Qumranet Kvm	Up to 81
Qemu Qemu	Before 0.10.0

Running on/with	Platform Versions
Canonical Ubuntu Linux	All versions
Debian Debian Linux	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (40)

http://git.kernel.dk/?p=qemu.git%3Ba=commitdiff%3Bh=65d35a09979e63541afc5bfc595b9f1b1b4ae069

Source: cve@mitre.org

http://groups.google.com/group/linux.debian.changes.devel/msg/9e0dc008572f2867?dmode=source

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/25073

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/29129

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33350

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34642

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35031

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35062

Source: cve@mitre.org

Third Party Advisory

http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5587

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2009/dsa-1799

Source: cve@mitre.org

Third Party Advisory

http://www.mail-archive.com/cvs-all%40freebsd.org/msg129730.html

Source: cve@mitre.org

http://www.mail-archive.com/secure-testing-commits%40lists.alioth.debian.org/msg09322.html

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-776-1

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=237342

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=448525

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=466890

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/47736

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://launchpad.net/ubuntu/jaunty/+source/qemu/0.9.1+svn20081112-1ubuntu1

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01223.html

Source: cve@mitre.org

Third Party Advisory

http://git.kernel.dk/?p=qemu.git%3Ba=commitdiff%3Bh=65d35a09979e63541afc5bfc595b9f1b1b4ae069