Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2016-5126

Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 10 more
CVE-2016-5238

Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd

The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5337

Qemu: scsi: megasas: information leakage in megasas_ctrl_get_info

The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5338

Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO

The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 12 more
CVE-2016-6351

Qemu: scsi: esp: OOB write access in esp_do_dma

The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-6490

Qemu: virtio: infinite loop in virtqueue_pop

The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-6833

Qemu: net: vmxnet3: use-after-free while writing to device

Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-6834

Qemu: net: vmxnet3: an infinite loop during packet fragmentation

The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-6835

Qemu: net: vmxnet: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation

The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 1 more
CVE-2016-6836

Qemu: net: vmxnet: Information leakage in vmxnet3_complete_packet

The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-6888

Qemu: net: vmxnet: integer overflow in packet initialisation

Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2016-7116

Qemu: 9p: directory traversal flaw in 9p virtio backend

Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7155

Qemu: scsi: pvscsi: OOB read and infinite loop while setting descriptor rings

hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7156

Qemu: scsi: pvscsi: infintie loop when building SG list

The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7157

Qemu: scsi: mptsas: invalid memory access while building configuration pages

The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-7161

Qemu: net: xilinx_ethlite: heap buffer overflow in eth_rx

Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.

CVSS 3.1 · 9.8 Critical EPSS 6.1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7170

Qemu: vmware_vga: OOB stack memory access when processing svga command

The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-7421

Qemu: scsi: pvscsi: infinite loop when processing IO requests

The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-7422

Qemu: virtio: null pointer dereference in virtqueu_map_desc

The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu Redhat
Products
Leap Qemu Enterprise Linux and 2 more