CVE-2017-5931

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
http://www.openwall.com/lists/oss-security/2017/02/08/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/96141Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1420092Issue Tracking, Patch, Third Party Advisory
https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201702-28Third Party Advisory
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
http://www.openwall.com/lists/oss-security/2017/02/08/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/96141Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1420092Issue Tracking, Patch, Third Party Advisory
https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201702-28Third Party Advisory

Timeline

Published: Mar 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-59327.8The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) ch CVE-2017-59335.9Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly gen CVE-2017-59346.1Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbi CVE-2017-59367.5OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allo CVE-2017-59376.5The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS u CVE-2017-59386.1Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows re CVE-2017-59408.8Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent CVE-2017-59419.8An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploi CVE-2017-59426.1An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected X CVE-2017-59438.8Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information CVE-2017-59448.8The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remo CVE-2017-59456.1An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insufficient filtration of us