CVE-2008-4539
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU...
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
CVE-2008-4539- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
CVE-2008-4539- Updated
- 2026-11-02
EUVDEUVD-2008-4520 No score
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
EUVD-2008-4520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gq7c-3rjh-ggvh No score
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU...
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
GHSA-gq7c-3rjh-ggvh- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
CVE-2008-4539- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-4539 No score
Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
- Record
DEBIAN-CVE-2008-4539- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10233-1 No score
qemu-2.6.1-1.5 on GA media
These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10233-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10285-1 No score
qemu-linux-user-2.6.1-1.5 on GA media
These are all security issues fixed in the qemu-linux-user-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10285-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:12 |
before 0.9.1+svn20081101-1 | 0.9.1+svn20081101-1 |
qemuDebian:13 |
before 0.9.1+svn20081101-1 | 0.9.1+svn20081101-1 |
qemuDebian:14 |
before 0.9.1+svn20081101-1 | 0.9.1+svn20081101-1 |
qemuDebian:4.0 From an advisory covering 3 CVEs |
before 0.8.2-4etch3, plus listed versions 0.8.2-40.8.2-4etch10.8.2-4etch2 |
0.8.2-4etch3 |
qemuDebian:5.0 From an advisory covering 3 CVEs |
before 0.9.1-10lenny1, plus listed versions 0.9.1-100.9.1-10lenny1~bpo40+1 |
0.9.1-10lenny1 |
qemuopenSUSE:Tumbleweed From an advisory covering 53 CVEs |
before 2.6.1-1.5 | 2.6.1-1.5 |
qemu-linux-useropenSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 2.6.1-1.5 | 2.6.1-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-4539 is a high vulnerability (CVSS 7.2) in Debian Linux, published December 29, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in qemu 0.9.1+svn20081101-1.
References
secunia.com/advisories/35062
mail-archive.com/secure-testing-commits%40lists.alioth.debian.org/msg09322.html
redhat.com/archives/fedora-package-announce/2008-December/msg01223.html
Show 73 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=466890
ubuntu.com/usn/usn-776-1
exchange.xforce.ibmcloud.com/vulnerabilities/47736
lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
svn.savannah.gnu.org/viewvc?view=rev&root=qemu&revision=5587
debian.org/security/2009/dsa-1799
groups.google.com/group/linux.debian.changes.devel/msg/9e0dc008572f2867?dmode=source
git.kernel.dk?p=qemu.git%3Ba=commitdiff%3Bh=65d35a09979e63541afc5bfc595b9f1b1b4ae069
launchpad.net/ubuntu/jaunty/+source/qemu/0.9.1+svn20081112-1ubuntu1
nvd.nist.gov/vuln/detail/CVE-2008-4539
github.com/advisories/GHSA-gq7c-3rjh-ggvh
security-tracker.debian.org/tracker/CVE-2008-4539
suse.com/security/cve/CVE-2008-0928