CVE-2007-5730

Description

Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	qemu	0.9.0-2	—
Debian 13	qemu	0.9.0-2	—
Debian 12	qemu	0.9.0-2	—
Debian 4.0	qemu	0.8.2-4etch1	DSA-1284-1
Debian 3.1	qemu	0.6.1+20050407-1sarge1	DSA-1284-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 5	xen +1	3.0.3-41.el5_1.5	RHSA-2008:0194

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Virtualization 5	xen +1	3.0.3-41.el5_1.5	RHSA-2008:0194

Advisories 2

RHSA-2008:0194 Red Hat Security Advisory: xen security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-1284-1 qemu Debian Security (DSA / DLA) · Mar 9, 2026

References

23731 vdb-entry
MDKSA-2007:203 vendor-advisory
RHSA-2008:0194 vendor-advisory
qemu-net-socket-bo(38239) vdb-entry
42985 vdb-entry
DSA-1284 vendor-advisory
25073 third-party-advisory
http://taviso.decsystem.org/virtsec.pdf
27486 third-party-advisory
MDVSA-2008:162 vendor-advisory
oval:org.mitre.oval:def:10000 vdb-entry signature
29963 third-party-advisory
ADV-2007-1597 vdb-entry
29129 third-party-advisory
25095 third-party-advisory
20071030 Clarification on old QEMU/NE2000/Xen issues mailing-list

Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via craf…