CVE-2007-2893

Name	CVE-2007-2893
Description	Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1351-1
Debian Bugs	427144

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bochs (PTS)	jessie	2.6-2	fixed
	stretch	2.6-5	fixed
	buster	2.6.9+dfsg-3	fixed
	bullseye	2.6.11+dfsg-4	fixed
	bookworm	2.7+dfsg-4	fixed
	sid, trixie	2.8+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
bochs	source	sarge	2.1.1+20041109-3sarge1		DSA-1351-1
bochs	source	etch	2.3-2etch1		DSA-1351-1
bochs	source	(unstable)	2.3+20070705-1	low		427144

kvm/qemu are tracked as CVE-2007-5729 and CVE-2007-5730