CVE-2009-3616
- State
- Published
- Severity
- Not scored
- Published
- Oct 23, 2009
- Updated
- Aug 7, 2024
- Reserved
- Oct 9, 2009
Description
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=501131
- http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331
- [oss-security] 20091016 Re: QEMU VNC use-after-freemailing-list
- http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5
- [qemu-devel] 20090525 Re: [STABLE] [BUG] VNC mode can crash QEMUmailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=508567
- 36716vdb-entry
- http://rhn.redhat.com/errata/RHEA-2009-1272.html
- [oss-security] 20091016 QEMU VNC use-after-freemailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=505641
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.