CVE-2015-8504

LOW

Description

Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.

References

http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8

http://www.debian.org/security/2016/dsa-3469

http://www.debian.org/security/2016/dsa-3470

http://www.debian.org/security/2016/dsa-3471

http://www.openwall.com/lists/oss-security/2015/12/08/7

http://www.securityfocus.com/bid/78708

https://bugzilla.redhat.com/show_bug.cgi?id=1289541

https://security.gentoo.org/glsa/201602-01

Details

Source: MITRE

Published: 2017-04-11

Updated: 2020-09-09

Type: CWE-369

Risk Information

CVSS v2.0

Base Score: 3.5

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 6.8

Severity: LOW

CVSS v3.0

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.4.1 (inclusive)

cpe:2.3:a:qemu:qemu:2.5.0:rc0:*:*:*:*:*:*

cpe:2.3:a:qemu:qemu:2.5.0:rc1:*:*:*:*:*:*

cpe:2.3:a:qemu:qemu:2.5.0:rc2:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Tenable Plugins

View all (26 total)

IDNameProductFamilySeverity
135559EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)NessusHuawei Local Security Checks
critical
131585EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431)NessusHuawei Local Security Checks
high
94000openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster)NessusSuSE Local Security Checks
high
93180SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)NessusSuSE Local Security Checks
high
93177SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1)NessusSuSE Local Security Checks
high
93170SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)NessusSuSE Local Security Checks
high
93169SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)NessusSuSE Local Security Checks
high
91980openSUSE Security Update : qemu (openSUSE-2016-839)NessusSuSE Local Security Checks
high
91660SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)NessusSuSE Local Security Checks
high
91249SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1)NessusSuSE Local Security Checks
high
90759SUSE SLES11 Security Update : xen (SUSE-SU-2016:1154-1)NessusSuSE Local Security Checks
high
90396SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1)NessusSuSE Local Security Checks
high
90186SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1)NessusSuSE Local Security Checks
high
89723SUSE SLES10 Security Update : Xen (SUSE-SU-2016:0658-1)NessusSuSE Local Security Checks
high
89377Fedora 22 : qemu-2.3.1-9.fc22 (2015-b406a8e4f2)NessusFedora Local Security Checks
low
89375Fedora 23 : qemu-2.4.1-3.fc23 (2015-b2e8518b8e)NessusFedora Local Security Checks
low
89151Fedora 23 : xen-4.5.2-5.fc23 (2015-12a089920e)NessusFedora Local Security Checks
high
88630Debian DSA-3471-1 : qemu - security updateNessusDebian Local Security Checks
high
88629Debian DSA-3470-1 : qemu-kvm - security updateNessusDebian Local Security Checks
high
88628Debian DSA-3469-1 : qemu - security updateNessusDebian Local Security Checks
high
88587GLSA-201602-01 : QEMU: Multiple vulnerabilities (Venom)NessusGentoo Local Security Checks
critical
88576Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : qemu, qemu-kvm vulnerabilities (USN-2891-1)NessusUbuntu Local Security Checks
high
88126openSUSE Security Update : xen (openSUSE-2016-36)NessusSuSE Local Security Checks
high
88125openSUSE Security Update : xen (openSUSE-2016-35)NessusSuSE Local Security Checks
high
88124openSUSE Security Update : xen (openSUSE-2016-34)NessusSuSE Local Security Checks
high
87696FreeBSD : qemu -- denial of service vulnerability in VNC (67feba97-b1b5-11e5-9728-002590263bf5)NessusFreeBSD Local Security Checks
low