An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver.

Published 8 y ago 2018-07-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.0 · CNA

CISA KEV

not known exploited

EPSS

3.1%

percentile 88%

Public exploits

none known

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.

Exploit prediction (EPSS)

3.08% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.4	`CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L`
CNA	3.0	5.4	`CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L`
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:N/I:N/A:P`

Affected products

QEMU Qemu:

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input
CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write

References

openwall.com /lists/oss-security/2017/02/23/1 · mailing-list, x_refsource_MLIST, x_transferred
git.qemu.org /?p=qemu.git%3Ba=commitdiff%3Bh=bea60dd7679364493a0d7f5b54316c767cf894ef · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:1206 · vendor-advisory, x_refsource_REDHAT, x_transferred
git.qemu.org /?p=qemu.git%3Ba=commitdiff%3Bh=9f64916da20eea67121d544698676295bbb105a7 · x_refsource_CONFIRM, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2633 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:1441 · vendor-advisory, x_refsource_REDHAT, x_transferred
securityfocus.com /bid/96417 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2017:1856 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:1205 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

CVE List: CVE-2017-2633
NVD: CVE-2017-2633

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.