[Secure-testing-team] Bug#553589: CVE-2009-3616: Multiple use-after-free vulnerabilities in vnc.c
Giuseppe Iuculano
iuculano at debian.org
Sun Nov 1 10:09:27 UTC 2009
Package: qemu
Version: 0.10.6-1
Severity: grave
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for qemu.
CVE-2009-3616[0]:
| Multiple use-after-free vulnerabilities in vnc.c in the VNC server in
| QEMU 0.10.6 and earlier might allow guest OS users to execute
| arbitrary code on the host OS by establishing a connection from a VNC
| client and then (1) disconnecting during data transfer, (2) sending a
| message using incorrect integer data types, or (3) using the Fuzzy
| Screen Mode protocol, related to double free vulnerabilities.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3616
http://security-tracker.debian.org/tracker/CVE-2009-3616
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkrtXlEACgkQNxpp46476ao3NgCdGPnMHfTITK7HUXeruU2ZGG/2
bsEAn2GLZX9LZxbBxn6T+lwsQ/yjX/8R
=F/Fd
-----END PGP SIGNATURE-----
More information about the Secure-testing-team
mailing list