Secure testing team - Nov 2009 - Bug#553590: CVE-2009-3616: Multiple use-after-free vulnerabilities in vnc.c

Package: kvm
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for kvm.

CVE-2009-3616[0]:
| Multiple use-after-free vulnerabilities in vnc.c in the VNC server in
| QEMU 0.10.6 and earlier might allow guest OS users to execute
| arbitrary code on the host OS by establishing a connection from a VNC
| client and then (1) disconnecting during data transfer, (2) sending a
| message using incorrect integer data types, or (3) using the Fuzzy
| Screen Mode protocol, related to double free vulnerabilities.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3616
    http://security-tracker.debian.org/tracker/CVE-2009-3616


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkrtYAYACgkQNxpp46476aqAZQCggUoTDn0woH1Gq2ho3OClxwxR
zQMAn26utjy966AXv1YpjIZB9YzErFhw
=iWBL
-----END PGP SIGNATURE-----