Description
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.4+dfsg-1a | — |
| Debian 13 | qemu | 1:2.4+dfsg-1a | — |
| Debian 12 | qemu | 1:2.4+dfsg-1a | — |
| Debian 8 | qemu | 1:2.1+dfsg-12+deb8u2 | DSA-3348-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qemu-img-rhev +6 | 10:2.1.2-23.el7_1.9 | RHSA-2015:1837 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | qemu-img-rhev +5 | 10:2.1.2-23.el7_1.9 | RHSA-2015:1772 |
| Red Hat OpenStack 6 | qemu-img-rhev +6 | 10:2.1.2-23.el7_1.9 | RHSA-2015:1772 |
| Red Hat OpenStack 5 | qemu-img-rhev +6 | 10:2.1.2-23.el7_1.9 | RHSA-2015:1772 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Advisories 4
- RHSA-2015:1837 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1772 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-3348-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [Qemu-deve] 20150915 [ANNOUNCE] QEMU 2.4.0.1 CVE update released mailing-list
- [Qemu-devel] 20150821 [PATCH] vnc: fix memory corruption (CVE-2015-5225) mailing-list
- RHSA-2015:1837 vendor-advisory
- FEDORA-2015-14783 vendor-advisory
- DSA-3348 vendor-advisory
- FEDORA-2015-16368 vendor-advisory
- RHSA-2015:1772 vendor-advisory
- 1033547 vdb-entry
- [oss-security] 20150822 CVE-2015-5225 Qemu: ui: vnc: heap memory corruption issue mailing-list
- 76506 vdb-entry
- FEDORA-2015-15364 vendor-advisory
- GLSA-201602-01 vendor-advisory