QEMU 'vmstate _ xhci_event 'field Memory Corruption Vulnerability

QEMU 'vmstate _ xhci_event 'field Memory Corruption Vulnerability

 

Release date:

Updated on:

 

Affected Systems:

QEMU

Description:

Bugtraq id: 69247

CVE (CAN) ID: CVE-2014-5263

 

QEMU is an open source simulator software.

 

The vmstate_xhci_event of QEMU lacks the Field List Terminator. The local memory corruption vulnerability exists in the implementation. attackers on the client operating system can exploit this vulnerability to damage the QEMU process memory.

 

<* Source: Laszlo Ersek

*>

 

Suggestion:

Vendor patch:

 

QEMU

----

The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

 

Http://fabrice.bellard.free.fr/qemu/