Skip to content
Fencer Vulns
medium 5.4

CVE-2017-2633 json

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver.

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11794

cvss
5.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.

Patch / fix

  • qemu qemu 1.7.2
  • qemu Debian 14, Debian 13, Debian 12 2.1+dfsg-1

debian advisories DEBIAN-CVE-2017-2633

  • qemu Ubuntu 14.04 LTS 2.0.0+dfsg-2ubuntu1.33

ubuntu advisories UBUNTU-CVE-2017-2633

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • qemu-kvm RHEL 7 10:1.5.3-141.el7
  • qemu-img RHEL 7 10:1.5.3-141.el7
  • qemu-kvm-tools RHEL 7 10:1.5.3-141.el7
  • qemu-kvm-common RHEL 7 10:1.5.3-141.el7
  • qemu-kvm-rhev RHEL 6, openstack 5 2:0.12.1.2-2.503.el6_9.3
  • qemu-img-rhev RHEL 6, openstack 5 2:0.12.1.2-2.503.el6_9.3
  • qemu-kvm-rhev-tools RHEL 6, openstack 5 2:0.12.1.2-2.503.el6_9.3
  • qemu-kvm RHEL 6 2:0.12.1.2-2.503.el6_9.3

red hat advisories RHSA-2017:1856RHSA-2017:1205RHSA-2017:1206RHSA-2017:1441

  • kvm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 1.4.2-53.14.1
  • kvm SLES for SAP 11 SP4, SLES 11 SP4 1.4.2-60.6.1
  • xen SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 4.5.5_10-22.14.1
  • xen SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 4.4.4_16-54.1
  • qemu SLES 12-LTSS 2.0.2-48.34.3
  • xen SLES for SAP 12, SLES 12-LTSS 4.4.4_16-22.36.1

suse advisories SUSE-SU-2018:0039-1SUSE-SU-2018:0019-1SUSE-SU-2017:2969-1SUSE-SU-2017:1147-1SUSE-SU-2017:1081-1SUSE-SU-2017:1080-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2633 updated cvss 5.4

Qemu: VNC: memory corruption due to unchecked resolution limit

  • Red Hat Enterprise Linux 5 kvm, xen Red Hat Enterprise Linux 6 qemu-kvm-rhev Red Hat Enterprise Linux 7 qemu-kvm-rhev
    affected: no fix available
  • Red Hat Enterprise Linux Client (v. 7) qemu-img 1.5.3-141.el7, qemu-kvm 1.5.3-141.el7, qemu-kvm-tools 1.5.3-141.el7, qemu-kvm-common 1.5.3-141.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img 1.5.3-141.el7, qemu-kvm 1.5.3-141.el7, qemu-kvm-tools 1.5.3-141.el7, qemu-kvm-common 1.5.3-141.el7
    fixed: vendor fix RHSA-2017:1856
  • Red Hat Enterprise Linux Desktop (v. 6) qemu-img 0.12.1.2-2.503.el6_9.3, qemu-kvm 0.12.1.2-2.503.el6_9.3, qemu-kvm-tools 0.12.1.2-2.503.el6_9.3, qemu-guest-agent 0.12.1.2-2.503.el6_9.3 Red Hat Enterprise Linux HPC Node (v. 6) qemu-img 0.12.1.2-2.503.el6_9.3, qemu-kvm 0.12.1.2-2.503.el6_9.3, qemu-kvm-tools 0.12.1.2-2.503.el6_9.3, qemu-guest-agent 0.12.1.2-2.503.el6_9.3
    fixed: vendor fix RHSA-2017:1206
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 qemu-img-rhev 0.12.1.2-2.503.el6_9.3, qemu-kvm-rhev 0.12.1.2-2.503.el6_9.3, qemu-kvm-rhev-tools 0.12.1.2-2.503.el6_9.3
    fixed: vendor fix RHSA-2017:1441
  • Red Hat Enterprise Linux Server (v. 6) qemu-img 0.12.1.2-2.503.el6_9.3, qemu-kvm 0.12.1.2-2.503.el6_9.3, qemu-kvm-tools 0.12.1.2-2.503.el6_9.3, qemu-guest-agent 0.12.1.2-2.503.el6_9.3
    fixed: vendor fix RHSA-2017:1206
  • Red Hat Enterprise Linux Server (v. 7) qemu-img 1.5.3-141.el7, qemu-kvm 1.5.3-141.el7, qemu-kvm-tools 1.5.3-141.el7, qemu-kvm-common 1.5.3-141.el7
    fixed: vendor fix RHSA-2017:1856
  • Red Hat Enterprise Linux Workstation (v. 6) qemu-img 0.12.1.2-2.503.el6_9.3, qemu-kvm 0.12.1.2-2.503.el6_9.3, qemu-kvm-tools 0.12.1.2-2.503.el6_9.3, qemu-guest-agent 0.12.1.2-2.503.el6_9.3
    fixed: vendor fix RHSA-2017:1206
  • Red Hat Enterprise Linux Workstation (v. 7) qemu-img 1.5.3-141.el7, qemu-kvm 1.5.3-141.el7, qemu-kvm-tools 1.5.3-141.el7, qemu-kvm-common 1.5.3-141.el7
    fixed: vendor fix RHSA-2017:1856
show 2 more
  • Red Hat RHEV Agents (vdsm) qemu-img-rhev 0.12.1.2-2.503.el6_9.3, qemu-kvm-rhev 0.12.1.2-2.503.el6_9.3, qemu-kvm-rhev-tools 0.12.1.2-2.503.el6_9.3
    fixed: vendor fix RHSA-2017:1205
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno) qemu-kvm-rhev Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more Red Hat OpenStack Platform 8 (Liberty) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more Red Hat OpenStack Platform 9 (Mitaka) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more Red Hat OpenStack Platform 10 (Newton) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.08% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

  • QEMU Qemu:

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
  • CWE-125 Out-of-bounds Read
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.