Lucene search

Ubuntu.comUB:CVE-2013-4377

HistoryOct 11, 2013 - 12:00 a.m.

CVE-2013-4377

2013-10-1100:00:00

ubuntu.com

2.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:M/Au:S/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0
through 1.6.0 allows local users to cause a denial of service (daemon
crash) by “hot-unplugging” a virtio device.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=1012633>

Notes

Author	Note
seth-arnold	Vulnerability introduced in 1.4.0
mdeslaur	as of 2013-12-09, not yet in upstream repo v3 of patch proposed 2013-10-15: http://article.gmane.org/gmane.comp.emulators.qemu/238070 v4 of patch proposed 2013-11-29: http://article.gmane.org/gmane.comp.emulators.qemu/244052

OSVersionArchitecturePackageVersionFilename
ubuntu13.10noarchqemu< 1.5.0+dfsg-3ubuntu5.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	13.10	noarch	qemu	< 1.5.0+dfsg-3ubuntu5.3	UNKNOWN

References

thread.gmane.org/gmane.comp.emulators.qemu/234440

www.openwall.com/lists/oss-security/2013/09/26/4

launchpad.net/bugs/cve/CVE-2013-4377

nvd.nist.gov/vuln/detail/CVE-2013-4377

security-tracker.debian.org/tracker/CVE-2013-4377

ubuntu.com/security/notices/USN-2092-1

www.cve.org/CVERecord?id=CVE-2013-4377

2.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:M/Au:S/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for UB:CVE-2013-4377