Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 194

Export CSV
CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 12 more
CVE-2014-3469

libtasn1: asn1_read_value_type() NULL pointer dereference

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Gnu Redhat and 1 more
Products
Debian Linux Gnutls Libtasn1 and 12 more
CVE-2016-5126

Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 10 more
CVE-2016-4020

Qemu: i386: leakage of stack memory to guest in kvmvapic.c

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-3710

qemu: incorrect banked access bounds checking in vga module

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 4 more
Products
Ubuntu Linux Xenserver Debian Linux and 14 more
CVE-2014-3468

libtasn1: asn1_get_bit_der() can return negative bit length

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.

CVSS 2.0 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Debian F5 Gnu and 2 more
Products
Debian Linux Arx Arx Firmware and 14 more
CVE-2016-2857

Qemu: net: out of bounds read in net_checksum_calculate()

The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2014-3467

libtasn1: multiple boundary check issues

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.

CVSS 2.0 · 5.0 Medium EPSS 6.8% KEV · Not listed
Vendors
Debian F5 Gnu and 2 more
Products
Debian Linux Arx Arx Firmware and 14 more
CVE-2016-1568

Qemu: ide: ahci use-after-free vulnerability in aio port commands

Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2015-7512

Qemu: net: pcnet: buffer overflow in non-loopback mode

Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.

CVSS 3.1 · 9.0 Critical EPSS 7.7% KEV · Not listed
Vendors
Debian Oracle Qemu and 1 more
Products
Debian Linux Linux Qemu and 7 more
CVE-2011-3571

OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)

Unspecified vulnerability in the Virtual Desktop Infrastructure (VDI) component in Oracle Virtualization 3.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Session. NOTE: this CVE identifier was accidentally used for a Concurrency issue in Java Runtime Environment, but that issue has been reassigned to CVE-2012-0507.

CVSS 2.0 · 3.6 Low EPSS 1.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Virtualization Enterprise Linux Rhel Extras
CVE-2013-4344

qemu: buffer overflow in scsi_target_emulate_report_luns

Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Opensuse Qemu and 1 more
Products
Ubuntu Linux Opensuse Qemu and 5 more
CVE-2012-3515

qemu: VT100 emulation vulnerability

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 4 more
Products
Ubuntu Linux Debian Linux Opensuse and 12 more
CVE-2012-6075

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.

CVSS 2.0 · 9.3 Critical EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2009-4272

kernel: emergency route cache flushing leads to node deadlock

A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.

CVSS 3.1 · 7.5 High EPSS 11.1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2023-5366

Openvswitch don't match packets on nd_target field

A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Fast Datapath and 4 more
CVE-2021-3620

Ansible: ansible-connection module discloses sensitive info in traceback error message

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Early Access Ansible Engine and 9 more
CVE-2022-2132

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

CVSS 3.1 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Debian Dpdk Fedoraproject and 1 more
Products
Debian Linux Data Plane Development Kit Fedora and 12 more
CVE-2022-0516

kernel: missing check in ioctl allows kernel memory read/write

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 29 more