CVE-2014-0150

QEMU < 2.0 - Remote Code Execution via MAC Address Table Update

Title source: llm
STIX 2.1

Description

Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.

References (8)

Core 8
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1078846
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2910
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2182-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2909
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57878
Various Sources mailing-list x_refsource_mlist
http://article.gmane.org/gmane.comp.emulators.qemu/266768
Patch mailing-list x_refsource_mlist
http://thread.gmane.org/gmane.comp.emulators.qemu/266713
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/58191

Scores

EPSS 0.0047
EPSS Percentile 64.8%

Details

CWE
CWE-189
Status published
Products (45)
qemu/qemu 0.1.0
qemu/qemu 0.1.1
qemu/qemu 0.1.2
qemu/qemu 0.1.3
qemu/qemu 0.1.4
qemu/qemu 0.1.5
qemu/qemu 0.1.6
qemu/qemu 0.2.0
qemu/qemu 0.3.0
qemu/qemu 0.4.0
... and 35 more
Published Apr 18, 2014
Tracked Since Feb 18, 2026