Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2015-4106

xen: unmediated PCI register access in qemu (xsa-131)

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 3 more
Products
Ubuntu Linux Xenserver Debian Linux and 5 more
CVE-2016-7908

Qemu: net: Infinite loop in mcf_fec_do_tx()

The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7907

Qemu: net: inifinte loop in imx_fec_do_tx() function

The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2015-4037

qemu: insecure temporary file use in /net/slirp.c

The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-9776

Qemu: net: mcf_fec: infinite loop while receiving data in mcf_fec_receive

QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-9845

Qemu: display: virtio-gpu-3d: information leakage in virgl_cmd_get_capset_info

QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2013-4531

qemu: target-arm/machine.c: fix buffer overflow on invalid state load

Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-9907

Qemu: usb: redirector: memory leakage when destroying redirector

Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2016-9908

Qemu: display: virtio-gpu: information leakage in virgl_cmd_get_capset

Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-9911

Qemu: usb: ehci: memory leakage in ehci_init_transfer

Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2016-7466

Qemu: usb: xhci memory leakage during device unplug

Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu Redhat
Products
Leap Qemu Enterprise Linux and 2 more
CVE-2016-7423

Qemu: scsi: mptsas: OOB access when freeing MPTSASRequest object

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2015-3456

qemu: fdc: out-of-bounds fifo buffer memory access

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

CVSS 2.0 · 7.7 High EPSS 15.3% KEV · Not listed
Vendors
Qemu Redhat Xen
Products
Qemu Enterprise Linux Enterprise Virtualization and 4 more
CVE-2016-7422

Qemu: virtio: null pointer dereference in virtqueu_map_desc

The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu Redhat
Products
Leap Qemu Enterprise Linux and 2 more
CVE-2016-7421

Qemu: scsi: pvscsi: infinite loop when processing IO requests

The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2015-3214

qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.

CVSS 2.0 · 6.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Arista Debian Lenovo and 3 more
Products
Eos Debian Linux Emc Px12-400r Ivx and 17 more
CVE-2013-4530

qemu: pl022: fix buffer overun on invalid state load

Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.

CVSS 2.0 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-7170

Qemu: vmware_vga: OOB stack memory access when processing svga command

The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-7161

Qemu: net: xilinx_ethlite: heap buffer overflow in eth_rx

Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.

CVSS 3.1 · 9.8 Critical EPSS 6.1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2015-3209

qemu: pcnet: multi-tmd buffer overflow in the tx path

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

CVSS 2.0 · 7.5 High EPSS 9.7% KEV · Not listed
Vendors
Arista Canonical Debian and 5 more
Products
Eos Ubuntu Linux Debian Linux and 17 more