2017-10-16 12:31:07 -04:00
{
2023-02-02 21:00:39 +00:00
"data_version" : "4.0" ,
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
2019-03-17 21:35:53 +00:00
"CVE_data_meta" : {
"ID" : "CVE-2017-15124" ,
2023-02-02 21:00:39 +00:00
"ASSIGNER" : "secalert@redhat.com" ,
2019-03-17 21:35:53 +00:00
"STATE" : "PUBLIC"
} ,
2023-02-02 21:00:39 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "VNC server implementation in Quick Emulator (QEMU) was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host."
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "Allocation of Resources Without Limits or Throttling" ,
"cweId" : "CWE-770"
}
]
}
]
} ,
2019-03-17 21:35:53 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
2023-02-02 21:00:39 +00:00
"vendor_name" : "Red Hat" ,
2019-03-17 21:35:53 +00:00
"product" : {
"product_data" : [
{
2023-02-02 21:00:39 +00:00
"product_name" : "Red Hat Enterprise Linux 7" ,
2019-03-17 21:35:53 +00:00
"version" : {
"version_data" : [
{
2023-02-02 21:00:39 +00:00
"version_value" : "10:1.5.3-156.el7" ,
"version_affected" : "!"
} ,
{
"version_value" : "10:2.12.0-18.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat OpenStack Platform 10.0 (Newton)" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat OpenStack Platform 11.0 (Ocata)" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat OpenStack Platform 12.0 (Pike)" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat OpenStack Platform 8.0 (Liberty)" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat OpenStack Platform 9.0 (Mitaka)" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
}
]
}
} ,
{
"product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7" ,
"version" : {
"version_data" : [
{
"version_value" : "10:2.10.0-21.el7" ,
"version_affected" : "!"
2019-03-17 21:35:53 +00:00
}
]
}
}
]
2023-02-02 21:00:39 +00:00
}
2019-03-17 21:35:53 +00:00
}
]
}
} ,
"references" : {
"reference_data" : [
{
2023-02-02 21:00:39 +00:00
"url" : "http://www.securityfocus.com/bid/102295" ,
"refsource" : "MISC" ,
"name" : "http://www.securityfocus.com/bid/102295"
} ,
{
"url" : "https://access.redhat.com/errata/RHSA-2018:0816" ,
"refsource" : "MISC" ,
"name" : "https://access.redhat.com/errata/RHSA-2018:0816"
} ,
{
"url" : "https://access.redhat.com/errata/RHSA-2018:1104" ,
"refsource" : "MISC" ,
"name" : "https://access.redhat.com/errata/RHSA-2018:1104"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://access.redhat.com/errata/RHSA-2018:1113" ,
"refsource" : "MISC" ,
"name" : "https://access.redhat.com/errata/RHSA-2018:1113"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://access.redhat.com/errata/RHSA-2018:3062" ,
"refsource" : "MISC" ,
"name" : "https://access.redhat.com/errata/RHSA-2018:3062"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://access.redhat.com/security/cve/CVE-2017-15124" ,
"refsource" : "MISC" ,
"name" : "https://access.redhat.com/security/cve/CVE-2017-15124"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1525195" ,
"refsource" : "MISC" ,
"name" : "https://bugzilla.redhat.com/show_bug.cgi?id=1525195"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://usn.ubuntu.com/3575-1/" ,
"refsource" : "MISC" ,
"name" : "https://usn.ubuntu.com/3575-1/"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"url" : "https://www.debian.org/security/2018/dsa-4213" ,
"refsource" : "MISC" ,
"name" : "https://www.debian.org/security/2018/dsa-4213"
}
]
} ,
"credits" : [
{
"lang" : "en" ,
"value" : "This issue was discovered by Daniel Berrange (Red Hat)."
}
] ,
"impact" : {
"cvss" : [
{
"accessComplexity" : "HIGH" ,
"accessVector" : "NETWORK" ,
"authentication" : "SINGLE" ,
"availabilityImpact" : "PARTIAL" ,
"availabilityRequirement" : "NOT_DEFINED" ,
"baseScore" : 2.1 ,
"collateralDamagePotential" : "NOT_DEFINED" ,
"confidentialityImpact" : "NONE" ,
"confidentialityRequirement" : "NOT_DEFINED" ,
"environmentalScore" : 0 ,
"exploitability" : "NOT_DEFINED" ,
"integrityImpact" : "NONE" ,
"integrityRequirement" : "NOT_DEFINED" ,
"remediationLevel" : "NOT_DEFINED" ,
"reportConfidence" : "NOT_DEFINED" ,
"targetDistribution" : "NOT_DEFINED" ,
"temporalScore" : 0 ,
"vectorString" : "AV:N/AC:H/Au:S/C:N/I:N/A:P" ,
"version" : "2.0"
2019-03-17 21:35:53 +00:00
} ,
{
2023-02-02 21:00:39 +00:00
"attackComplexity" : "HIGH" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "LOW" ,
"baseScore" : 3.5 ,
"baseSeverity" : "LOW" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "LOW" ,
"scope" : "CHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" ,
"version" : "3.0"
2019-03-17 21:35:53 +00:00
}
]
}
}