CVE ID:	CVE-2008-4539
Description:	Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
Test IDs:	1.3.6.1.4.1.25623.1.0.61840   1.3.6.1.4.1.25623.1.0.63995   1.3.6.1.4.1.25623.1.0.63053   1.3.6.1.4.1.25623.1.0.61881
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2008-4539 Debian Security Information: DSA-1799 (Google Search) http://www.debian.org/security/2009/dsa-1799 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01223.html http://www.mail-archive.com/cvs-all@freebsd.org/msg129730.html http://groups.google.com/group/linux.debian.changes.devel/msg/9e0dc008572f2867?dmode=source http://www.mail-archive.com/secure-testing-commits@lists.alioth.debian.org/msg09322.html http://secunia.com/advisories/25073 http://secunia.com/advisories/29129 http://secunia.com/advisories/33350 http://secunia.com/advisories/34642 http://secunia.com/advisories/35031 http://secunia.com/advisories/35062 SuSE Security Announcement: SUSE-SR:2009:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://www.ubuntu.com/usn/usn-776-1 XForce ISS Database: qemu-kvm-cirrusvga-bo(47736) https://exchange.xforce.ibmcloud.com/vulnerabilities/47736