CVE - CVE-2015-5225

CVE-ID
CVE-2015-5225	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1033547 URL:http://www.securitytracker.com/id/1033547 MISC:76506 URL:http://www.securityfocus.com/bid/76506 MISC:DSA-3348 URL:http://www.debian.org/security/2015/dsa-3348 MISC:FEDORA-2015-14783 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165484.html MISC:FEDORA-2015-15364 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166798.html MISC:FEDORA-2015-16368 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html MISC:GLSA-201602-01 URL:https://security.gentoo.org/glsa/201602-01 MISC:RHSA-2015:1772 URL:http://rhn.redhat.com/errata/RHSA-2015-1772.html MISC:RHSA-2015:1837 URL:http://rhn.redhat.com/errata/RHSA-2015-1837.html MISC:[Qemu-deve] 20150915 [ANNOUNCE] QEMU 2.4.0.1 CVE update released URL:https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html MISC:[Qemu-devel] 20150821 [PATCH] vnc: fix memory corruption (CVE-2015-5225) URL:https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg02495.html MISC:[oss-security] 20150822 CVE-2015-5225 Qemu: ui: vnc: heap memory corruption issue URL:http://www.openwall.com/lists/oss-security/2015/08/21/6
Assigning CNA
Red Hat, Inc.
Date Record Created
20150701	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150701)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)