Qemu is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Information
SuSE Linux Enterprise Server for SAP 12
SuSE Linux Enterprise Server 12-LTSS
QEMU QEMU 0
openSUSE Leap 42.2
Gentoo Linux
Citrix XenServer 6.0.2 Common Criteria
Citrix XenServer 6.0.2
Citrix XenServer 7.0
Citrix XenServer 6.5 SP1
Citrix XenServer 6.5
Citrix XenServer 6.2.0 Sp1
Citrix XenServer 6.2
References:
- [Qemu-devel] [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cp (GNU)
- Bug 1420484 - (CVE-2017-2620) CVE-2017-2620 Qemu: display: cirrus: potential arb (Redhat)
- CTX220771: Citrix XenServer Multiple Security Updates (Citrix)
- Xen Security Advisory 209 (CVE-2017-2620) - cirrus_bitblt_cputovideo does not ch (Seclists.org)