CVE-2017-9524

The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.

• CWE-20

• http://www.debian.org/security/2017/dsa-3925Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/06/12/1Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/99011Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1681Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1682Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06240.htmlPatch, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02321.htmlPatch, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3925Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/06/12/1Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/99011Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1681Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1682Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06240.htmlPatch, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02321.htmlPatch, Third Party Advisory

Published

Jul 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9518atmail before 7.8.0.2 has CSRF, allowing an attacker to chan…
• CVE-2017-9519atmail before 7.8.0.2 has CSRF, allowing an attacker to crea…
• CVE-2017-9520The r_config_set function in libr/config/config.c in radare2…
• CVE-2017-9521The Comcast firmware on Cisco DPC3939 (firmware version dpc3…9.8
• CVE-2017-9522The Time Warner firmware on Technicolor TC8717T devices sets…
• CVE-2017-9523The Sophos Web Appliance before 4.3.2 has XSS in the FTP red…
• CVE-2017-9525In the cron package through 3.0pl1-128 on Debian, and throug…6.7
• CVE-2017-9526In Libgcrypt before 1.7.7, an attacker who learns the EdDSA …
• CVE-2017-9527The mark_context_stack function in gc.c in mruby through 1.2…7.8
• CVE-2017-9528IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows r…
• CVE-2017-9529XnView Classic for Windows Version 2.40 allows remote attack…
• CVE-2017-9530IrfanView version 4.44 (32bit) might allow attackers to caus…