CVE-2015-5745

Name	CVE-2015-5745
Description	Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3348-1, DSA-3349-1
Debian Bugs	795087

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	bullseye	1:5.2+dfsg-11+deb11u3	fixed
	bullseye (security)	1:5.2+dfsg-11+deb11u4	fixed
	bookworm	1:7.2+dfsg-7+deb12u12	fixed
	sid, trixie	1:10.0.0+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
qemu	source	squeeze	(not affected)
qemu	source	wheezy	1.1.2+dfsg-6a+deb7u9
qemu	source	jessie	1:2.1+dfsg-12+deb8u2	DSA-3348-1
qemu	source	(unstable)	1:2.4+dfsg-1a		795087
qemu-kvm	source	squeeze	(not affected)
qemu-kvm	source	wheezy	1.1.2+dfsg-6+deb7u9	DSA-3349-1
qemu-kvm	source	(unstable)	(unfixed)

Notes

[squeeze] - qemu <not-affected> (Vulnerable code introduced later)
[squeeze] - qemu-kvm <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2015/08/06/3
Fixed by: http://git.qemu.org/?p=qemu.git;a=commitdiff;h=7882080388be5088e72c425b02223c02e6cb4295 (v2.4.0-rc3)
Introduced in: http://git.qemu.org/?p=qemu.git;a=commitdiff;h=98b19252cf1bd97c54bc4613f3537c5ec0aae263 (v0.13.0-rc0)
Patch for wheezy needs change since uses iov_from_buf:
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dcf6f5e15ecee4f593eeacbe0591c1addc004d92
iov_* function changed in http://git.qemu.org/?p=qemu.git;a=commitdiff;h=2278a69e7020d86a8c73a28474e7709d3e7d5081 (v1.2.0-rc0)