CVE-2017-2620
- Source
- https://cve.org/CVERecord?id=CVE-2017-2620
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-2620.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-2620
- Downstream
- Related
- Published
- 2018-07-27T19:29:00.330Z
- Modified
- 2026-05-28T04:03:49.361719172Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrusbitbltcputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "last_affected": "4.7.1" } ], "vendor_product": "xen:xen", "cpes": [ "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE" }, { "extracted_events": [ { "last_affected": "6.0.2" }, { "last_affected": "6.2.0-sp1" }, { "last_affected": "6.5-sp1" }, { "last_affected": "7.0" }, { "last_affected": "7.1" } ], "cpes": [ "cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:citrix:xenserver:6.2.0:sp1:*:*:*:*:*:*", "cpe:2.3:a:citrix:xenserver:6.5:sp1:*:*:*:*:*:*", "cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "citrix:xenserver" }, { "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "extracted_events": [ { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_desktop" }, { "extracted_events": [ { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "vendor_product": "redhat:enterprise_linux_server", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "7.3" }, { "last_affected": "7.4" } ], "vendor_product": "redhat:enterprise_linux_server_aus", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "7.3" }, { "last_affected": "7.4" }, { "last_affected": "7.5" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_eus" }, { "extracted_events": [ { "last_affected": "6.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_workstation", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ] }, { "extracted_events": [ { "last_affected": "5.0" }, { "last_affected": "6.0" }, { "last_affected": "7.0" }, { "last_affected": "8" }, { "last_affected": "9" }, { "last_affected": "10" } ], "cpes": [ "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:openstack" }, { "extracted_events": [ { "last_affected": "4.7.1-r1" }, { "last_affected": "4.7.1-r2" }, { "last_affected": "4.7.1-r3" }, { "last_affected": "4.7.1-r4" }, { "last_affected": "4.7.1-r5" }, { "last_affected": "4.7.1-r6" }, { "last_affected": "4.7.1-r7" } ], "vendor_product": "xen:xen", "cpes": [ "cpe:2.3:o:xen:xen:4.7.1:r1:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r2:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r3:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r4:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r5:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r6:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.7.1:r7:*:*:*:*:*:*" ], "source": "CPE_STRING" } ] }- References
-
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- http://rhn.redhat.com/errata/RHSA-2017-0328.html
- http://rhn.redhat.com/errata/RHSA-2017-0329.html
- http://rhn.redhat.com/errata/RHSA-2017-0330.html
- http://rhn.redhat.com/errata/RHSA-2017-0331.html
- http://rhn.redhat.com/errata/RHSA-2017-0332.html
- http://rhn.redhat.com/errata/RHSA-2017-0333.html
- http://rhn.redhat.com/errata/RHSA-2017-0334.html
- http://rhn.redhat.com/errata/RHSA-2017-0350.html
- http://rhn.redhat.com/errata/RHSA-2017-0351.html
- http://rhn.redhat.com/errata/RHSA-2017-0352.html
- http://rhn.redhat.com/errata/RHSA-2017-0396.html
- http://rhn.redhat.com/errata/RHSA-2017-0454.html
- http://www.openwall.com/lists/oss-security/2017/02/21/1
- http://www.securityfocus.com/bid/96378
- http://www.securitytracker.com/id/1037870
- https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html
- https://security.gentoo.org/glsa/201703-07
- https://security.gentoo.org/glsa/201704-01
- https://support.citrix.com/article/CTX220771
- https://xenbits.xen.org/xsa/advisory-209.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html
Affected packages
Git / github.com/qemu/qemu
Affected versions
v0.*
v0.1.0
v0.1.1
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.11.0-rc0
v0.12.0-rc0
v0.13.0-rc0
v0.14.0-rc0
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v1.*
v1.0
v1.0-rc0
v1.0-rc1
v1.0-rc2
v1.0-rc3
v1.0-rc4
v1.1-rc0
v1.1-rc1
v1.1-rc2
v1.1.0
v1.1.0-rc2
v1.1.0-rc3
v1.1.0-rc4
v1.2.0
v1.2.0-rc0
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.3.0
v1.3.0-rc0
v1.3.0-rc1
v1.3.0-rc2
v1.4.0
v1.4.0-rc0
v1.4.0-rc1
v1.4.0-rc2
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.7.0-rc2
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.1.0-rc4
v2.1.0-rc5
v2.2.0
v2.2.0-rc0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.2.0-rc4
v2.2.0-rc5
v2.3.0
v2.3.0-rc0
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc3
v2.3.0-rc4
v2.4.0
v2.4.0-rc0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.4.0-rc4
v2.5.0
v2.5.0-rc0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.6.0-rc4
v2.6.0-rc5
v2.7.0
v2.7.0-rc0
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.0-rc4
v2.7.0-rc5
v2.8.0-rc0
v2.8.0-rc1
v2.8.0-rc2
v2.8.0-rc3
v2.8.0-rc4
Git / gitlab.com/qemu-project/qemu
Affected versions
v0.*
v0.1.0
v0.1.1
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.11.0-rc0
v0.12.0-rc0
v0.13.0-rc0
v0.14.0-rc0
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v1.*
v1.0
v1.0-rc0
v1.0-rc1
v1.0-rc2
v1.0-rc3
v1.0-rc4
v1.1-rc0
v1.1-rc1
v1.1-rc2
v1.1.0
v1.1.0-rc2
v1.1.0-rc3
v1.1.0-rc4
v1.2.0
v1.2.0-rc0
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.3.0
v1.3.0-rc0
v1.3.0-rc1
v1.3.0-rc2
v1.4.0
v1.4.0-rc0
v1.4.0-rc1
v1.4.0-rc2
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.7.0-rc2
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.1.0-rc4
v2.1.0-rc5
v2.2.0
v2.2.0-rc0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.2.0-rc4
v2.2.0-rc5
v2.3.0
v2.3.0-rc0
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc3
v2.3.0-rc4
v2.4.0
v2.4.0-rc0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.4.0-rc4
v2.5.0
v2.5.0-rc0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.6.0-rc4
v2.6.0-rc5
v2.7.0
v2.7.0-rc0
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.0-rc4
v2.7.0-rc5
v2.8.0-rc0
v2.8.0-rc1
v2.8.0-rc2
v2.8.0-rc3
v2.8.0-rc4