CVE-2015-5279

Publication date 15 September 2015

Last updated 24 July 2024

Ubuntu priority

Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
qemu	15.04 vivid	Fixed 1:2.2+dfsg-5expubuntu9.5
	14.04 LTS trusty	Fixed 2.0.0+dfsg-2ubuntu1.19
	12.04 LTS precise	Not in release
qemu-kvm	15.04 vivid	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Fixed 1.0+noroms-0ubuntu14.25

Notes

tyhicks

Mitigated by AppArmor confinement when QEMU is managed by libvirt.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
qemu	Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=9bbdbc66e5765068dce76e9269dce4547afd8ad4

CVE-2015-5279

Status

Notes

tyhicks

Patch details

References

Related Ubuntu Security Notices (USN)

Other references