CVE-2015-1779

Опубликовано: 12 янв. 2016

Источник: nvd

CVSS3: 8.6

CVSS2: 7.8

EPSS Низкий

Описание

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2015-1931.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1943.html
Third Party Advisory
http://www.debian.org/security/2015/dsa-3259
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/24/9
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/09/6
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Third Party Advisory
http://www.securityfocus.com/bid/73303
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1033975
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2608-1
Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html
Mailing List
Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html
Mailing List
Patch
Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html
Mailing List
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201602-01
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html
Broken Link

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Версия до 2.2.1 (включая)

cpe:2.3:a:qemu:qemu:2.3.0:rc0:*:*:*:*:*:*

cpe:2.3:a:qemu:qemu:2.3.0:rc1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Конфигурация 7

cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.05081

Низкий

8.6 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

Связанные уязвимости

CVE-2015-1779

CVSS3: 8.6

ubuntu

больше 9 лет назад

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

CVE-2015-1779

redhat

больше 10 лет назад

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

CVE-2015-1779

CVSS3: 8.6

debian

больше 9 лет назад

The VNC websocket frame decoder in QEMU allows remote attackers to cau ...

GHSA-cmjj-4jjr-c8vv

CVSS3: 8.6

github

больше 3 лет назад

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

ELSA-2015-1943

oracle-oval

почти 10 лет назад

ELSA-2015-1943: qemu-kvm security update (MODERATE)

EPSS

Процентиль: 89%

0.05081

Низкий

8.6 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400