CVE-2023-3255

2023-09-1316:12:52

Debian Security Bug Tracker

security-tracker.debian.org

qemu

vnc

denial of service

0.001 Low

EPSS

Percentile

47.7%

JSON

A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the inflate_buffer function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:7.2+dfsg-7+deb12u2qemu_1:7.2+dfsg-7+deb12u2_all.deb
Debian11allqemu< 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian10allqemu< 1:3.1+dfsg-8+deb10u8qemu_1:3.1+dfsg-8+deb10u8_all.deb
Debian999allqemu< 1:8.0.4+dfsg-1qemu_1:8.0.4+dfsg-1_all.deb
Debian13allqemu< 1:8.0.4+dfsg-1qemu_1:8.0.4+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	< 1:7.2+dfsg-7+deb12u2	qemu_1:7.2+dfsg-7+deb12u2_all.deb
Debian	11	all	qemu	< 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	10	all	qemu	< 1:3.1+dfsg-8+deb10u8	qemu_1:3.1+dfsg-8+deb10u8_all.deb
Debian	999	all	qemu	< 1:8.0.4+dfsg-1	qemu_1:8.0.4+dfsg-1_all.deb
Debian	13	all	qemu	< 1:8.0.4+dfsg-1	qemu_1:8.0.4+dfsg-1_all.deb