Medium severity5.5NVD Advisory· Published Jul 25, 2017· Updated Jun 17, 2026

CVE-2017-11434

Description

The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

QEMU/Qemu6 versions
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*range: <=2.9.1
- cpe:2.3:a:qemu:qemu:2.10.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.10.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.10.0:rc3:*:*:*:*:*:*
- (no CPE)
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords35 versions
pkg:rpm/opensuse/qemu&distro=openSUSE%20Tumbleweed pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/kvm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/qemu&distro=SUSE%20OpenStack%20Cloud%206 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%206
< 6.1.0-32.1+ 34 more
- (no CPE)range: < 6.1.0-32.1
- (no CPE)range: < 1.4.2-53.11.1
- (no CPE)range: < 1.4.2-53.11.1
- (no CPE)range: < 1.4.2-53.11.1
- (no CPE)range: < 1.4.2-60.3.1
- (no CPE)range: < 1.4.2-60.3.1
- (no CPE)range: < 2.6.2-41.22.2
- (no CPE)range: < 2.9.0-6.3.1
- (no CPE)range: < 2.3.1-33.3.3
- (no CPE)range: < 2.6.2-41.22.2
- (no CPE)range: < 2.9.0-6.3.1
- (no CPE)range: < 2.0.2-48.34.3
- (no CPE)range: < 2.6.2-41.22.2
- (no CPE)range: < 2.3.1-33.3.3
- (no CPE)range: < 2.6.2-41.22.2
- (no CPE)range: < 2.9.0-6.3.1
- (no CPE)range: < 2.3.1-33.3.3
- (no CPE)range: < 4.7.3_03-43.9.1
- (no CPE)range: < 4.9.0_11-3.9.1
- (no CPE)range: < 4.2.5_21-45.5.1
- (no CPE)range: < 4.2.5_21-45.5.1
- (no CPE)range: < 4.4.4_22-61.9.2
- (no CPE)range: < 4.5.5_14-22.25.1
- (no CPE)range: < 4.7.3_03-43.9.1
- (no CPE)range: < 4.9.0_11-3.9.1
- (no CPE)range: < 4.4.4_22-22.51.2
- (no CPE)range: < 4.4.4_22-61.9.2
- (no CPE)range: < 4.4.4_22-22.51.2
- (no CPE)range: < 4.5.5_14-22.25.1
- (no CPE)range: < 4.7.3_03-43.9.1
- (no CPE)range: < 4.9.0_11-3.9.1
- (no CPE)range: < 4.4.4_22-61.9.2
- (no CPE)range: < 4.7.3_03-43.9.1
- (no CPE)range: < 4.9.0_11-3.9.1
- (no CPE)range: < 4.5.5_14-22.25.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2017/07/19/2nvdMailing ListPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party Advisory
lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.htmlnvdIssue TrackingPatchThird Party Advisory
www.debian.org/security/2017/dsa-3925nvdThird Party Advisory
www.securityfocus.com/bid/99923nvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000