Read the docs
TI-2015-04387 Aliases CVE-2015-5225GHSA-xf7r-x3p2-rg72

Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in…

Priority LOW 32CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.

Why it matters now

EPSS 0.00533 45th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*21VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*22VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*23VulnerableFedoraproject
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*up to 2.4.0VulnerableQEMU
  • cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* Versions 21 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
  • cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions up to 2.4.0 Vulnerable ·QEMU

Remediation

Red Hat 2 advisories

  • RHSA-2015:1837 Released 2015-09-24 · Red Hat rating Important
    qemu-kvm-rhev security update
    • RHEV-H and VDSM for 7 Hosts libcacard-devel-rhev-10:2.1.2-23.el7_1.9, libcacard-rhev-10:2.1.2-23.el7_1.9, libcacard-tools-rhev-10:2.1.2-23.el7_1.9 +4
  • RHSA-2015:1772 Released 2015-09-14 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 libcacard-devel-rhev-10:2.1.2-23.el7_1.9, libcacard-rhev-10:2.1.2-23.el7_1.9, libcacard-tools-rhev-10:2.1.2-23.el7_1.9 +4
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 libcacard-devel-rhev-10:2.1.2-23.el7_1.9, libcacard-rhev-10:2.1.2-23.el7_1.9, libcacard-tools-rhev-10:2.1.2-23.el7_1.9 +4
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 libcacard-rhev-10:2.1.2-23.el7_1.9, libcacard-tools-rhev-10:2.1.2-23.el7_1.9, qemu-img-rhev-10:2.1.2-23.el7_1.9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEV-H and VDSM for 7 HostsFixed RHSA-2015:1837
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:1772
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2015:1772
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2015:1772
Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-5225
  2. 2026-10-03 Alias added: GHSA-xf7r-x3p2-rg72

References

Patch 1

Advisory 7

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences