VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
|Base Score:||7.5||Base Metrics:||AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|
|Access Vector:||Network||Attack Complexity:||Low|
|Privileges Required:||None||User Interaction:||None|
|Integrity Impact:||None||Availability Impact:||High|
|Oracle Linux version 7 (qemu)||ELSA-2018-4285||2018-11-20|
|Oracle Linux version 7 (qemu)||ELSA-2018-4289||2018-11-28|
|Oracle Linux version 7 (qemu)||ELSA-2019-4585||2019-03-15|
|Oracle Linux version 7 (qemu-kvm)||ELSA-2018-0816||2018-04-16|
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team