CVE-2008-1945
Fixed in a distro release EPSS <1%
QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
Products: qemu, opensuse, suse linux_enterprise_server, debian_linux, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 0.9.1-5 |
| Debian 13 | qemu | 0.9.1-5 |
| Debian 14 | qemu | 0.9.1-5 |
| Debian 4.0 | qemu | 0.8.2-4etch3 |
| Debian 5.0 | qemu | 0.9.1-10lenny1 |
| Red Hat Enterprise Linux 5 | xen | 0:3.0.3-64.el5_2.3 |
| Red Hat Enterprise Linux 5 | xen-debuginfo | 0:3.0.3-64.el5_2.3 |
| Red Hat Enterprise Linux 5 | xen-libs | 0:3.0.3-64.el5_2.3 |
| Red Hat rhel virtualization 5 | xen | 0:3.0.3-64.el5_2.3 |
| Red Hat rhel virtualization 5 | xen-debuginfo | 0:3.0.3-64.el5_2.3 |
| Red Hat rhel virtualization 5 | xen-devel | 0:3.0.3-64.el5_2.3 |
| openSUSE Tumbleweed | qemu | 2.6.1-1.5 |
| openSUSE Tumbleweed | qemu-linux-user | 2.6.1-1.5 |