QEMU < 2.1.0 - Denial of Service via VNC CLIENT_CUT_TEXT Message
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.