CVE-2013-4531

NameCVE-2013-4531
DescriptionBuffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs739589

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)jessie1:2.1+dfsg-12+deb8u6fixed
jessie (security)1:2.1+dfsg-12+deb8u7fixed
stretch (security), stretch1:2.8+dfsg-6+deb9u4fixed
buster, sid1:2.12+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusource(unstable)2.1+dfsg-1low739589
qemu-kvmsource(unstable)(unfixed)low

Notes

[wheezy] - qemu <no-dsa> (Minor issue, hardly exploitable in practice)
[squeeze] - qemu <no-dsa> (Minor issue, hardly exploitable in practice)
[wheezy] - qemu-kvm <no-dsa> (Minor issue, hardly exploitable in practice)
[squeeze] - qemu-kvm <no-dsa> (Minor issue, hardly exploitable in practice)

Search for package or bug name: Reporting problems