{"id":"USN-3289-1","summary":"qemu vulnerabilities","details":"Li Qiang discovered that QEMU incorrectly handled VirtFS directory sharing.\nA privileged attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2017-7377, CVE-2017-8086)\n\nJiangxin discovered that QEMU incorrectly handled the Cirrus VGA device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2017-7718)\n\nLi Qiang and Jiangxin discovered that QEMU incorrectly handled the Cirrus\nVGA device when being used with a VNC connection. A privileged attacker\ninside the guest could use this issue to cause QEMU to crash, resulting in\na denial of service, or possibly execute arbitrary code on the host. In the\ndefault installation, when QEMU is used with libvirt, attackers would be\nisolated by the libvirt AppArmor profile. (CVE-2017-7980)\n\nJiang Xin discovered that QEMU incorrectly handled the audio subsystem. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2017-8309)\n\nJiang Xin discovered that QEMU incorrectly handled the input subsystem. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-8379)\n","modified":"2026-02-10T04:41:07Z","published":"2017-05-16T16:12:20Z","related":["UBUNTU-CVE-2017-7377","UBUNTU-CVE-2017-7718","UBUNTU-CVE-2017-7980","UBUNTU-CVE-2017-8086","UBUNTU-CVE-2017-8309","UBUNTU-CVE-2017-8379"],"upstream":["CVE-2017-7377","CVE-2017-7718","CVE-2017-7980","CVE-2017-8086","CVE-2017-8309","CVE-2017-8379","UBUNTU-CVE-2017-7377","UBUNTU-CVE-2017-7718","UBUNTU-CVE-2017-7980","UBUNTU-CVE-2017-8086","UBUNTU-CVE-2017-8309","UBUNTU-CVE-2017-8379"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-3289-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-7377"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-7718"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-7980"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-8086"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-8309"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-8379"}],"affected":[{"package":{"name":"qemu","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/qemu@2.0.0+dfsg-2ubuntu1.34?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.34"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33"],"ecosystem_specific":{"binaries":[{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-common"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-guest-agent"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-keymaps"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-kvm"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-aarch64"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-arm"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-common"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-mips"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-misc"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-ppc"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-sparc"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-system-x86"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-user"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-user-static"},{"binary_version":"2.0.0+dfsg-2ubuntu1.34","binary_name":"qemu-utils"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3289-1.json","cves_map":{"cves":[{"id":"CVE-2017-7377","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-7718","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-7980","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2017-8086","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-8309","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:14.04:LTS"}}},{"package":{"name":"qemu","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/qemu@1:2.5+dfsg-5ubuntu10.14?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.14"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13"],"ecosystem_specific":{"binaries":[{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-block-extra"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-guest-agent"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-kvm"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-aarch64"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-arm"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-common"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-mips"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-misc"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-ppc"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-s390x"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-sparc"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-system-x86"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-user"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-user-binfmt"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-user-static"},{"binary_version":"1:2.5+dfsg-5ubuntu10.14","binary_name":"qemu-utils"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3289-1.json","cves_map":{"cves":[{"id":"CVE-2017-7377","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-7718","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-7980","severity":[{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2017-8086","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-8309","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2017-8379","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:16.04:LTS"}}}],"schema_version":"1.7.3"}