CVE-2017-15124
Last modified
CVE-2017-15124 is a vulnerability of currently unknown severity. VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. EPSS estimates a 2.84% chance of exploitation in the next 30 days.
Description
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | <= 2.11.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1525195Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1525195Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15124?
How severe is CVE-2017-15124?
How do I fix CVE-2017-15124?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-15118A stack-based buffer overflow vulnerability was found in NBD…8.3
- CVE-2017-15119The Network Block Device (NBD) server in Quick Emulator (QEM…5.8
- CVE-2017-15120An issue has been found in the parsing of authoritative answ…7.5
- CVE-2017-15121A non-privileged user is able to mount a fuse filesystem on …
- CVE-2017-15122Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15123A flaw was found in the CloudForms web interface, versions 5…5.3
- CVE-2017-15125A flaw was found in CloudForms before 5.9.0.22 in the self-s…6.5
- CVE-2017-15126A use-after-free flaw was found in fs/userfaultfd.c in the L…8.1
- CVE-2017-15127A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15128A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15129A use-after-free vulnerability was found in network namespac…4.7
- CVE-2017-15130A denial of service flaw was found in dovecot before 2.2.34.…
Are you affected by CVE-2017-15124?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST