CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2017-2630

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Score
5.5 medium
Published
2018-07-27
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
emulators/qemu-cheriqemu-cheri0.d20260108unaddressedbrooks@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>qemu-cheri</name>
	<range><lt>2.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stack buffer overflow flaw was found in the Quick Emulator (QEMU)
	before 2.9 built with the Network Block Device (NBD) client support.
	The flaw could occur while processing server's response to a
	'NBD_OPT_LIST' request. A malicious NBD server could use this issue to
	crash a remote NBD client resulting in DoS or potentially execute
	arbitrary code on client host with privileges of the QEMU process.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2017-2630</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2017-2630</url>
    </references>
    <dates>
      <discovery>2018-07-27</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>