|Description||The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: local)|
Vulnerable and fixed packages
The table below lists information on source packages.
|qemu (PTS)||jessie (security), jessie||1:2.1+dfsg-12+deb8u6||fixed|
|stretch (security), stretch||1:2.8+dfsg-6+deb9u4||fixed|
The information below is based on the following data on fixed versions.
- linux-2.6 <not-affected> (vulnerability does not affected kernel module)
- linux-2.6.24 <not-affected> (vulnerability does not affected kernel module)