CVE-2017-2620CWE-787

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue

Medium · published July 27, 2018

CVSS v3.0
5.5
EPSS
4%
Percentile
89.2
In the wild
Unconfirmed
What it is

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03559 · 89.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2018-07-27T19:00Z
EPSS history
Timeline
  • 27 JUL 19:00Z
    Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue
    cvelistv5