{"id":"CVE-2017-15118","aliases":["BELL-CVE-2017-15118","DEBIAN-CVE-2017-15118","EUVD-2017-6579","GHSA-p8q8-xqgv-rwvr","RHSA-2018:1104","RHSA-2018:1113","openSUSE-SU-2024:11287-1"],"status":"published","title":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before...","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","severity":{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.11931,"percentile":0.96141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2018-07-27T21:00:00Z","modified":"2026-10-24T10:30:43Z","exploits":[{"source":"exploitdb","id":"EDB-43194","title":"QEMU - NBD Server Long Export Name Stack Buffer Overflow","type":"dos","platform":"linux","date":"2017-11-29","verified":true,"url":"https://www.exploit-db.com/exploits/43194"}],"fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.11+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.11+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.11+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-32.1"}]}],"bundled":135}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1104","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3575-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/101975","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/11/28/8","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/43194/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15118","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p8q8-xqgv-rwvr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-15118","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15118","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1139507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1285044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320114","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1344299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1378241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1398633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1433670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1434321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1437113","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1445834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1453167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1489670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1489800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1491909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1492178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1492295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1499011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1499647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1501240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1501337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1501468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1502949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1507693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1510809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1511312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1513870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1516922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1516925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1520294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1520824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1523414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1525195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1525324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1525868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1526212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1526423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1528173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1529053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1529243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1529676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1530356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1534491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1542045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1104.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13673","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15118","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15119","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15124","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15124","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15268","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15268","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5683","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5683","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1113","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1557010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1557011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562826","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1113.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-03812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3682","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15118","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2018-07-27T21:00:00Z","modified":"2024-08-05T19:50:15.604Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:33:14.556599Z"}],"euvd":[{"id":"EUVD-2017-6579","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2018-07-27T21:00:00Z","modified":"2024-08-05T19:50:15Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T02:23:15.298105Z"}],"ghsa":[{"id":"GHSA-p8q8-xqgv-rwvr","title":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before...","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2022-05-13T01:37:33Z","modified":"2023-02-01T05:09:08Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:55.065879Z"}],"nvd":[{"id":"CVE-2017-15118","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2018-07-27T21:29:00.337Z","modified":"2026-06-17T01:07:16.833Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"BELL-CVE-2017-15118","title":"CVE-2017-15118 does not affect BellSoft software","status":"withdrawn","published":"2018-07-27T21:29:00Z","modified":"2026-01-26T09:49:59.058096Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-15118","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2018-07-27T21:29:00.337Z","modified":"2026-10-24T10:30:43.67816849Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15118","description":"A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.","status":"published","published":"2018-07-27T21:29:00.337Z","modified":"2026-09-01T20:03:44.459892447Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"RHSA-2018:1104","title":"Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update","status":"published","published":"2024-09-13T13:41:00Z","modified":"2026-07-01T10:03:35Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1113","title":"Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update","status":"published","published":"2024-09-13T13:41:05Z","modified":"2026-07-01T10:03:36Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"openSUSE-SU-2024:11287-1","title":"qemu-6.1.0-32.1 on GA media","description":"These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:57.481645Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}