medium6.5
CVE-2022-3165
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format.
Impact
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qemu | Qemu | from 6.1.0 through 7.1.0 |
| Fedoraproject | Fedora | Versions 36, 37 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gitlab.com/qemu-project/qemu/-/commit/d307040b18
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I36LKZA7Z65J3LJU2P37LVTWDFTXBMPU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/
- https://security.netapp.com/advisory/ntap-20221223-0006/
- https://gitlab.com/qemu-project/qemu/-/commit/d307040b18
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I36LKZA7Z65J3LJU2P37LVTWDFTXBMPU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/
- https://security.netapp.com/advisory/ntap-20221223-0006/