CVE-2016-9603

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 2.9

Description A heap buffer overflow issue was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support. The issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. This could allow a privileged user/process inside a guest to crash the QEMU process or potentially execute arbitrary code on the host with privileges of the QEMU process.

Recommendations For QEMU versions prior to 2.9, update to version 2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the VNC display driver support until a patch is available. Avoid using the VNC client to update its display after a VGA operation is performed by a guest until the issue is resolved.