{"id":"CVE-2017-6414","aliases":["DEBIAN-CVE-2017-6414","EUVD-2017-15471","GHSA-57wp-pwr5-mjc8","RHSA-2017:2408","SUSE-SU-2017:1058-1","SUSE-SU-2017:1080-1","SUSE-SU-2017:1081-1","SUSE-SU-2017:1147-1","UBUNTU-CVE-2017-6414","openSUSE-SU-2024:10928-1"],"status":"published","title":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local...","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00444,"percentile":0.389,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2017-03-15T14:00:00Z","modified":"2026-10-20T10:48:53Z","fixes":[{"ecosystem":"Debian:12","package":"libcacard","fixed_in":["1:2.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcacard","fixed_in":["1:2.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcacard","fixed_in":["1:2.5.0-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.0-3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.9.0-10.el7"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-22.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-22.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_10-22.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_10-22.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_10-22.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_10-22.14.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.0-2"]}],"products":[{"vendor":"libcacard_project","product":"libcacard"}],"references":[{"url":"http://www.securityfocus.com/bid/96541","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/03/01/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427833","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2408","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cgit.freedesktop.org/spice/libcacard/commit/?id=9113dc6a303604a2d9812ac70c17d076ef11886c","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://cgit.freedesktop.org/spice/libcacard/tree/NEWS?id=aaa5251791bf0b1640afcba77a7d79ea23c42d53","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6414","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57wp-pwr5-mjc8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-6414","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1376755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1415199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460170","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2408.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4020","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6888","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6888","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7422","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7466","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8576","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8669","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8909","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8910","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8910","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9907","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9911","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9911","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9921","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9922","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5579","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5579","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5973","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-6414","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6414","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8309","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8309","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8379","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9310","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9310","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9373","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9374","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9375","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9524","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027570","tags":["report"]},{"url":"https://bugzilla.suse.com/1028235","tags":["report"]},{"url":"https://bugzilla.suse.com/1030442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7228","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022555","tags":["report"]},{"url":"https://bugzilla.suse.com/1026636","tags":["report"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1028655","tags":["report"]},{"url":"https://bugzilla.suse.com/1029827","tags":["report"]},{"url":"https://bugzilla.suse.com/1030144","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2633","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171147-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1015348","tags":["report"]},{"url":"https://bugzilla.suse.com/1034843","tags":["report"]},{"url":"https://bugzilla.suse.com/1034844","tags":["report"]},{"url":"https://bugzilla.suse.com/1034845","tags":["report"]},{"url":"https://bugzilla.suse.com/1034994","tags":["report"]},{"url":"https://bugzilla.suse.com/1035483","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7980","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-6414","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-6414","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:00:00Z","modified":"2024-08-05T15:25:49.287Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-15471","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:00:00Z","modified":"2024-08-05T15:25:49Z","updated_at":"2026-11-03T02:39:12.564822Z"}],"ghsa":[{"id":"GHSA-57wp-pwr5-mjc8","title":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local...","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2022-05-13T01:26:26Z","modified":"2023-02-01T05:07:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:50:36.100181Z"}],"nvd":[{"id":"CVE-2017-6414","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:59:00.917Z","modified":"2026-06-17T01:22:18.29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"CVE-2017-6414","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:59:00.917Z","modified":"2026-10-20T10:48:53.764777674Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-6414","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:59:00.917Z","modified":"2026-09-01T20:03:49.65047769Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"RHSA-2017:2408","title":"Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update","status":"published","published":"2024-09-13T16:49:03Z","modified":"2026-06-29T10:17:11Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-6414","description":"Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.","status":"published","published":"2017-03-15T14:59:00Z","modified":"2026-04-22T11:29:33.967919Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"openSUSE-SU-2024:10928-1","title":"libcacard-devel-2.8.0-1.7 on GA media","description":"These are all security issues fixed in the libcacard-devel-2.8.0-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:06.578302Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:1058-1","title":"Security update for xen","description":"\nThis update for xen fixes the following security issues:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n","status":"published","published":"2017-04-19T07:16:18Z","modified":"2026-02-04T04:38:27.67392Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1080-1","title":"Security update for xen","description":"\nThis update for xen fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).\n- CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).\n\nThese non-security issues were fixed:\n\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'\n- bsc#1029827: Forward port xenstored\n","status":"published","published":"2017-04-20T13:47:19Z","modified":"2026-02-04T03:25:28.778948Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1081-1","title":"Security update for xen","description":"\nThis update for xen fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).\n- CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n- CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).\n\nThese non-security issues were fixed:\n\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'\n- bsc#1029827: Forward port xenstored\n","status":"published","published":"2017-04-20T13:47:43Z","modified":"2026-02-04T04:16:53.631257Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1147-1","title":"Security update for xen","description":"\nThis update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch (XSA-213, bsc#1034843)\n- A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks because of a missing check when transfering pages via GNTTABOP_transfer (XSA-214, bsc#1034844).\n- CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034994).\n- CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655)\n\nThese non-security issues were fixed:\n\n- bsc#1027519: Missing upstream bug fixes\n- bsc#1015348: libvirtd does not start during boot\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add\n","status":"published","published":"2017-05-02T12:48:45Z","modified":"2025-05-02T04:05:42.051843Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}