Description
Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labeled "NE2000 network driver and the socket code," but separate identifiers have been created for the individual vulnerabilities since there are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 0.9.0-2 | — |
| Debian 13 | qemu | 0.9.0-2 | — |
| Debian 12 | qemu | 0.9.0-2 | — |
| Debian 5.0 | kvm | 60+dfsg-1+lenny1 | DTSA-133-1 |
| Debian 5.0 | qemu | 0.8.2-5lenny1 | DTSA-38-1 |
| Debian 4.0 | qemu | 0.8.2-4etch1 | DSA-1284-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | qemu | 0.6.1+20050407-1sarge1 | DSA-1284-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xen +1 | 3.0.3-25.0.4.el5 | RHSA-2007:0323 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-25.0.4.el5 | RHSA-2007:0323 |
Advisories 4
- RHSA-2007:0323 Red Hat Security Advisory: xen security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-133-1 kvm - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1284-1 qemu Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-38-1 qemu - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 23731 vdb-entry
- MDKSA-2007:203 vendor-advisory
- FEDORA-2007-2270 vendor-advisory
- 27047 third-party-advisory
- DSA-1284 vendor-advisory
- 1018761 vdb-entry
- 25073 third-party-advisory
- http://taviso.decsystem.org/virtsec.pdf
- 27486 third-party-advisory
- MDVSA-2008:162 vendor-advisory
- 35495 vdb-entry
- ADV-2007-1597 vdb-entry
- FEDORA-2007-2708 vendor-advisory
- 27103 third-party-advisory
- 29129 third-party-advisory
- RHSA-2007:0323 vendor-advisory
- 25095 third-party-advisory
- 27072 third-party-advisory
- 20071030 Clarification on old QEMU/NE2000/Xen issues mailing-list
- FEDORA-2007-713 vendor-advisory
- oval:org.mitre.oval:def:9302 vdb-entry signature