CVE-2017-2620

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-125

Affected software

VendorProductVersions
QEMUQemu:2.8

References

Timeline

Published
Jul 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26215.5An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory wCVE-2017-26225.5An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readableCVE-2017-26235.3It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.CVE-2017-26247.0It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. CVE-2017-26255.5It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a locCVE-2017-26265.5It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for sessCVE-2017-26278.2A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP'CVE-2017-26289.8curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it didCVE-2017-26296.5curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificateCVE-2017-26308.8A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. TheCVE-2017-26324.9A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higherCVE-2017-26336.5An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while
CVE-2017-2620: Critical severity, CVSS 9.9 | Vulnix