Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.

hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.

ELSA-2018-4262: qemu security update (IMPORTANT)

ELSA-2018-4289: qemu security update (IMPORTANT)

ELSA-2018-4285: qemu security update (IMPORTANT)

ELSA-2019-4585: qemu security update (IMPORTANT)