Description
qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze1 | DSA-2230-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.113.el6_0.8 | RHSA-2011:0345 |
Advisories 2
- DSA-2230-1 qemu-kvm - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2011:0345 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 43733 third-party-advisory
- [oss-security] 20110110 Re: CVE request: qemu-kvm: Setting VNC password to empty string silently disables all authentication mailing-list
- [oss-security] 20110112 Re: CVE request: qemu-kvm: Setting VNC password to empty string silently disables all authentication mailing-list
- 44393 third-party-advisory
- [oss-security] 20110110 CVE request: qemu-kvm: Setting VNC password to empty string silently disables all authentication mailing-list
- RHSA-2011:0345 vendor-advisory
- 70992 vdb-entry
- qemu-vnc-security-bypass(65215) vdb-entry
- 42830 third-party-advisory
- USN-1063-1 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/697197
- 43272 third-party-advisory