CVE-2016-9603: citrix xenserver Heap-based Buffer Overflow

Vulnerability summary

CVE-2016-9603 is a critical (CVSS 9.9) Heap-based Buffer Overflow vulnerability in citrix xenserver. EPSS estimates a 4.45% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities.

Timeline

1. 27-07-2018
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.