CVE-2014-0147

Publication date 26 March 2014

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
qemu	14.04 LTS trusty	Not affected
	13.10 saucy	Ignored
	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	10.04 LTS lucid	Not in release
qemu-kvm	14.04 LTS trusty	Not in release
	13.10 saucy	Not in release
	12.10 quantal	Ignored
	12.04 LTS precise	Fixed 1.0+noroms-0ubuntu14.17
	10.04 LTS lucid	Fixed 0.12.3+noroms-0ubuntu9.24

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
qemu	Other: https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=246f65838d19db6db55bfb41117c35645a2c4789 Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=b106ad9185f35fc4ad669555ad0e79e276083bd7
qemu-kvm	Other: https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html

Severity score breakdown

Parameter	Value
Base score	6.2 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-2342-1
QEMU vulnerabilities
8 September 2014