Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2016-2392

Qemu: usb: null pointer dereference in remote NDIS control message handling

The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2016-2538

Qemu: usb: integer overflow in remote NDIS control message handling

Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-2841

Qemu: net: ne2000: infinite loop in ne2000_receive

The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2016-2857

Qemu: net: out of bounds read in net_checksum_calculate()

The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-2858

Qemu: rng-random: arbitrary stack based allocation leading to corruption

QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-3710

qemu: incorrect banked access bounds checking in vga module

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 4 more
Products
Ubuntu Linux Xenserver Debian Linux and 14 more
CVE-2016-3712

qemu-kvm: Out-of-bounds read when creating weird vga screen surface

Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 3 more
Products
Ubuntu Linux Xenserver Debian Linux and 9 more
CVE-2016-4001

Qemu: net: buffer overflow in stellaris_enet emulator

Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.

CVSS 3.1 · 8.6 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2016-4002

Qemu: net: buffer overflow in MIPSnet emulator

Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2016-4020

Qemu: i386: leakage of stack memory to guest in kvmvapic.c

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-4037

Qemu: usb: Infinite loop vulnerability in usb_ehci using siTD process

The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 1 more
Products
Ubuntu Linux Debian Linux Fedora and 1 more
CVE-2016-4439

Qemu: scsi: esp: OOB write while writing to 's->cmdbuf' in esp_reg_write

The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-4441

Qemu: scsi: esp: OOB write while writing to 's->cmdbuf' in get_cmd

The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-4453

Qemu: display: vmsvga: infinite loop in vmsvga_fifo_run() routine

The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-4454

Qemu: display: vmsvga: out-of-bounds read in vmsvga_fifo_read_raw() routine

The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-4952

Qemu: scsi: pvscsi: out-of-bounds access issue in pvsci_ring_init_msg/data routines

QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-4964

Qemu: scsi: mptsas infinite loop in mptsas_fetch_requests

The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-5105

Qemu: scsi: megasas: stack information leakage while reading configuration

The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5106

Qemu: scsi: megasas: out-of-bounds write while setting controller properties

The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5107

Qemu: scsi: megasas: out-of-bounds read in megasas_lookup_frame() function

The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu