Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might…

Description

Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.

Scores

EPSS (exploitation in 30 days)

0.54% · top 55% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• n/a
• CWE-119 (opens in a new tab)All about CWE-119 and its CVEs

Affected products

• n/a

  • affected n/a

References (20)

• 35062 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [secure-testing-commits] 20081103 r10251 - data/CVE (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cvs-all] 20081102 cvs commit: ports/emulators/qemu Makefile ports/emulators/qemu/files patch-CVE-2008-4539 ports/emulators/qemu-devel Makefile ports/emulators/qemu-devel/files patch-CVE-2008-4539 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FEDORA-2008-11705 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 25073 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 34642 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=466890 (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-776-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 33350 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=448525 (opens in a new tab)x_refsource_CONFIRMx_transferred
• qemu-kvm-cirrusvga-bo(47736) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=237342 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SUSE-SR:2009:008 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 29129 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5587 (opens in a new tab)x_refsource_CONFIRMx_transferred
• DSA-1799 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [debian-devel-changes] 20081101 Accepted qemu 0.9.1+svn20081101-1 (source amd64) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://git.kernel.dk/?p=qemu.git%3Ba=commitdiff%3Bh=65d35a09979e63541afc5bfc595b9f1b1b4ae069 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 35031 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://launchpad.net/ubuntu/jaunty/+source/qemu/0.9.1+svn20081112-1ubuntu1 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2008-4539](https://trackcve.app/badge/CVE-2008-4539.svg)](https://trackcve.app/cve/CVE-2008-4539)

Record last updated 7 Aug 2024, 10:17 UTC.