CVE-2007-1320

Name	CVE-2007-1320
Description	Multiple heap-based buffer overflows in the cirrus_invalidate_region function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other products, might allow local users to execute arbitrary code via unspecified vectors related to "attempting to mark non-existent regions as dirty," aka the "bitblt" heap overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1284-1, DSA-1384-1, DTSA-133-1, DTSA-38-1
Debian Bugs	424070, 444007

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	bullseye	1:5.2+dfsg-11+deb11u3	fixed
	bullseye (security)	1:5.2+dfsg-11+deb11u2	fixed
	bookworm	1:7.2+dfsg-7+deb12u7	fixed
	sid, trixie	1:9.2.0+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
kvm	source	lenny	60+dfsg-1+lenny1		DTSA-133-1
kvm	source	(unstable)	66+dfsg-1.1
qemu	source	sarge	0.6.1+20050407-1sarge1		DSA-1284-1
qemu	source	etch	0.8.2-4etch1		DSA-1284-1
qemu	source	lenny	0.8.2-5lenny1		DTSA-38-1
qemu	source	(unstable)	0.9.0-2			424070
xen-3	source	(unstable)	3.1.0-2	medium		444007
xen-3.0	source	etch	3.0.3-0-3		DSA-1384-1
xen-3.0	source	(unstable)	(unfixed)