CVE-2016-9603
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 4.4%
exploitation probability
4.4%top 10% of all CVEs
observed exploitation
nono source reports it
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
QEMU · Qemu:References
https://access.redhat.com/errata/RHSA-2017:0980https://access.redhat.com/errata/RHSA-2017:0981https://access.redhat.com/errata/RHSA-2017:0982https://access.redhat.com/errata/RHSA-2017:0983https://access.redhat.com/errata/RHSA-2017:0984https://access.redhat.com/errata/RHSA-2017:0985https://access.redhat.com/errata/RHSA-2017:0987https://access.redhat.com/errata/RHSA-2017:0988https://access.redhat.com/errata/RHSA-2017:1205https://access.redhat.com/errata/RHSA-2017:1206https://access.redhat.com/errata/RHSA-2017:1441https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603