CVE-2007-5729

Name	CVE-2007-5729
Description	The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1284-1
Debian Bugs	424070

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	buster	1:3.1+dfsg-8+deb10u8	fixed
	buster (security)	1:3.1+dfsg-8+deb10u12	fixed
	bullseye	1:5.2+dfsg-11+deb11u3	fixed
	bullseye (security)	1:5.2+dfsg-11+deb11u2	fixed
	bookworm	1:7.2+dfsg-7+deb12u5	fixed
	trixie	1:8.2.1+ds-2	fixed
	sid	1:8.2.2+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
kvm	source	(unstable)	72+dfsg-1
linux-2.6	source	(unstable)	(not affected)
linux-2.6.24	source	(unstable)	(not affected)
qemu	source	sarge	0.6.1+20050407-1sarge1	DSA-1284-1
qemu	source	etch	0.8.2-4etch1	DSA-1284-1
qemu	source	(unstable)	0.9.0-2		424070

Notes

- linux-2.6 <not-affected> (vulnerability does not affected kernel module)
- linux-2.6.24 <not-affected> (vulnerability does not affected kernel module)