CVE-2017-2633

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-2633
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://www.openwall.com/lists/oss-security/2017/02/23/1 Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/96417 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1205 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1206 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1441 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1856 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2633 Issue Tracking Patch Third Party Advisory
https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9f64916da20eea67121d544698676295bbb105a7
https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=bea60dd7679364493a0d7f5b54316c767cf894ef
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:43

Type Values Removed Values Added
References
  • {'url': 'https://git.qemu.org/?p=qemu.git;a=commitdiff;h=bea60dd7679364493a0d7f5b54316c767cf894ef', 'name': 'https://git.qemu.org/?p=qemu.git;a=commitdiff;h=bea60dd7679364493a0d7f5b54316c767cf894ef', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • {'url': 'https://git.qemu.org/?p=qemu.git;a=commitdiff;h=9f64916da20eea67121d544698676295bbb105a7', 'name': 'https://git.qemu.org/?p=qemu.git;a=commitdiff;h=9f64916da20eea67121d544698676295bbb105a7', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • () https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=bea60dd7679364493a0d7f5b54316c767cf894ef -
  • () https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9f64916da20eea67121d544698676295bbb105a7 -
Information

Published : 2018-07-27 19:29

Updated : 2023-12-10 12:44

NVD link : CVE-2017-2633

Mitre link : CVE-2017-2633

CVE.ORG link : CVE-2017-2633

JSON object : View

Products Affected

redhat

  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_server_eus

qemu

  • qemu
CWE
CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')