CVE-2015-3209

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

🔗 References (56)

• secalert@redhathttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
• secalert@redhathttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html
• secalert@redhathttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html
• secalert@redhathttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html
• secalert@redhathttp://rhn.redhat.com/errata/RHSA-2015-1087.html
• secalert@redhathttp://rhn.redhat.com/errata/RHSA-2015-1088.html