CVE-2008-5714
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess...
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
Exploit likelihood
What each source reports
NVD Score used
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
CVE-2008-5714- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
CVE-2008-5714- Updated
- 2026-11-02
EUVDEUVD-2008-5685 No score
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
EUVD-2008-5685- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8j8-f63m-pcx8 No score
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess...
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
GHSA-w8j8-f63m-pcx8- Updated
- 2026-11-02
OSV No score
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
CVE-2008-5714- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5714 No score
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
- Record
DEBIAN-CVE-2008-5714- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:12 |
before 0.9.1-10 | 0.9.1-10 |
qemuDebian:13 |
before 0.9.1-10 | 0.9.1-10 |
qemuDebian:14 |
before 0.9.1-10 | 0.9.1-10 |
kvmDebian:5.0 From an advisory covering 2 CVEs |
before 72+dfsg-5~lenny3, plus listed versions 72+dfsg-472+dfsg-5~lenny172+dfsg-5~lenny2 |
72+dfsg-5~lenny3 |
kvmDebian:6.0 From an advisory covering 2 CVEs |
before 72+dfsg-5+squeeze1, plus listed versions 11-111-212-114-118-1 Show 45 moreShow less28-128-228-328-428-4~bpo.13-136-0.14-14-246+dfsg-0.148+dfsg-15-15-252+dfsg-153-154+dfsg-155+dfsg-155+dfsg-257+dfsg-157+dfsg-258+dfsg-158+dfsg-260+dfsg-160+dfsg-1+lenny161+dfsg-162+dfsg-162+dfsg-262+dfsg-363+dfsg-163+dfsg-264+dfsg-165+dfsg-165+dfsg-266+dfsg-166+dfsg-1.169+dfsg-17-170+dfsg-171+dfsg-172+dfsg-172+dfsg-1.172+dfsg-272+dfsg-372+dfsg-472+dfsg-5 |
72+dfsg-5+squeeze1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5714 is a high vulnerability (CVSS 7.8) in Qemu, published December 24, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in qemu 0.9.1-10.
References
lists.gnu.org/archive/html/qemu-devel/2008-12/msg00498.html
secunia.com/advisories/35062
exchange.xforce.ibmcloud.com/vulnerabilities/47683
svn.savannah.gnu.org/viewvc?view=rev&root=qemu&revision=5966
Show 9 moreShow less
securityfocus.com/bid/33020
ubuntu.com/usn/usn-776-1
lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2008-5714
github.com/advisories/GHSA-w8j8-f63m-pcx8
security-tracker.debian.org/tracker/CVE-2008-5714
Left out here: 6 versions. The JSON record has them.