huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2017-7869: gnutls: Out-of-bounds write related to the cdk_pkt_read function (GNUTLS-SA-2017-3)
Component: gnutls
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-04-14T00:00:00+00:00

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_6_0
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 51464af713d71802e3c6d5ac15f1a95132a354fe
CVE-2017-7870: libreoffice: Heap-buffer-overflow in tools::Polygon::Insert
Component: libreoffice
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2017-01-10T00:00:00+00:00

An out-of-bounds write flaw was found in the way Libreoffice rendered certain documents containing Polygon images. By tricking a user into opening a specially crafted LibreOffice file, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.


Affected upstream versions: n/a
Fixed upstream versions: coas-0.1.0
Upstream repository: https://github.com/LibreOffice/core
Upstream fix commit: 62a97e6a561ce65e88d4c537a1b82c336f012722
CVE-2017-7889: kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism
Component: kernel
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-04-05T00:00:00+00:00

The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel
updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may
address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a4866aa812518ed1a37d8ea0c881dc946409de94
CVE-2017-7895: kernel: NFSv3 server does not properly handle payload bounds checking of WRITE requests
Component: kernel
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-04-28T00:00:00+00:00

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 13bf9fbff0e5e099e2b6f003a0ab8ae145436309
CVE-2017-8291: ghostscript: corruption of operand stack
Component: ghostscript
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2017-04-26T00:00:00+00:00

It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 04b37bbce174eed24edec7ad5b920eb93db4d47d
CVE-2017-8422: kauth: service invoking dbus is not properly checked and allows local privilege escalation
Component: kauth
Severity: Important
CWE: CWE-290 (Authentication Bypass by Spoofing)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-05-10T00:00:00+00:00

A privilege escalation flaw was found in the way kdelibs handled D-Bus messages. A local user could potentially use this flaw to gain root privileges by spoofing a callerID and leveraging a privileged helper application.


Affected upstream versions: n/a
Upstream repository: https://cgit.kde.org/kdelibs.git
Upstream fix commit: 264e97625abe2e0334f97de17f6ffb52582888ab
CVE-2017-8797: kernel: NFSv4 server does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2017-06-27T00:00:00+00:00

It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-lockup the system and thus cause denial of service.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for these products may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f961e3f2acae94b727380c0b74e2d3954d0edf79
CVE-2017-8890: kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-05-09T00:00:00+00:00

The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 657831ffc38e30092a2d5f03d385d710eb88b09a
CVE-2017-8932: golang: Elliptic curves carry propagation issue in x86-64 P-256
Component: golang
Severity: Moderate
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2017-05-23T00:00:00+00:00

A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could possibly use this flaw to extract private keys when static ECDH was used.


Affected upstream versions: n/a
Fixed upstream versions: go1.9
Upstream repository: https://github.com/golang/go
Upstream fix commit: 9294fa2749ffee7edbbb817a0ef9fe633136fa9c
CVE-2017-9074: kernel: net: IPv6 fragmentation implementation of nexthdr field may be associated with an invalid option
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-16T00:00:00+00:00

The IPv6 fragmentation implementation in the Linux kernel does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2423496af35d94a87156b063ea5cedffc10a70a1
CVE-2017-9075: kernel: net: sctp_v6_create_accept_sk function mishandles inheritance
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-05-17T00:00:00+00:00

The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8
CVE-2017-9076: kernel: net: IPv6 DCCP implementation mishandles inheritance
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-05-10T00:00:00+00:00

The IPv6 DCCP implementation in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 83eaddab4378db256d00d295bda6ca997cd13a52
CVE-2017-9077: kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-05-10T00:00:00+00:00

The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 83eaddab4378db256d00d295bda6ca997cd13a52
CVE-2017-9224: oniguruma: Out-of-bounds stack read in match_at() during regular expression searching
Component: oniguruma
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2017-05-22T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 690313a061f7a4fa614ec5cc8368b4f2284e059b
CVE-2017-9225: oniguruma: Out-of-bounds stack write in onigenc_unicode_get_case_fold_codes_by_str() during regular expression compilation
Component: oniguruma
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-22T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 166a6c3999bf06b4de0ab4ce6b088a468cc4029f
CVE-2017-9226: oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation
Component: oniguruma
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2017-05-18T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: f015fbdd95f76438cd86366467bb2b39870dd7c6
CVE-2017-9227: oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching
Component: oniguruma
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-23T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814
CVE-2017-9228: oniguruma: Out-of-bounds heap write in bitset_set_range()
Component: oniguruma
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-23T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: 3b63d12038c8d8fc278e81c942fa9bec7c704c8b
CVE-2017-9229: oniguruma: Invalid pointer dereference in left_adjust_char_head()
Component: oniguruma
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-05-23T00:00:00+00:00

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.


Affected upstream versions: n/a
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/kkos/oniguruma
Upstream fix commit: b690371bbf97794b4a1d3f295d4fb9a8b05d402d
CVE-2017-9242: kernel: Incorrect overwrite check in __ip6_append_data()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-19T00:00:00+00:00

The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 232cd35d0804cc241eb887bb8d4d9b3b9881c64a
CVE-2017-9310: Qemu: net: infinite loop in e1000e NIC emulation
Component: Qemu
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-02-10T00:00:00+00:00

QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 4154c7e03fa55b4cf52509a83d50d6c09d743b7
CVE-2017-9373: Qemu: ide: ahci host memory leakage during hotunplug
Component: Qemu
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-03-16T00:00:00+00:00

Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: d68f0f778e7f4fbd674627274267f269e40f0b04
CVE-2017-9374: Qemu: usb: ehci host memory leakage during hotunplug
Component: Qemu
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-02-08T00:00:00+00:00

Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: d710e1e7bd3d5bfc26b631f02ae87901ebe646b0
CVE-2017-9375: Qemu: usb: xhci infinite recursive call via xhci_kick_ep
Component: Qemu
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-02-02T00:00:00+00:00

QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 96d87bdda3919bb16f754b3d3fd1227e1f38f13c