Critical severity · published Oct 23, 2009
CVE-2009-3616
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a…
9.9
CVSS
3.9%
EPSS
No
On KEV
Description
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Server · Redhat
5.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
5.0 · source: NVD
QE
Qemu · Qemu
through 0.10.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3616
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3616
Broken Link
http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5
Broken Link
http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331
Mailing List
http://marc.info/?l=qemu-devel&m=124324043812915
Third Party Advisory
http://rhn.redhat.com/errata/RHEA-2009-1272.html
Mailing List
http://www.openwall.com/lists/oss-security/2009/10/16/5
Mailing List
http://www.openwall.com/lists/oss-security/2009/10/16/8
More from Qemu
10.0
CVE-2022-36648
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially…
10.0
CVE-2017-16845
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access
10.0
CVE-2015-8556
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1
9.9
CVE-2016-9603
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update…
9.9
CVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue