Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2016-2197

Qemu: ide: ahci null pointer dereference when using FIS CLB engines

QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-2538

Qemu: usb: integer overflow in remote NDIS control message handling

Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-2841

Qemu: net: ne2000: infinite loop in ne2000_receive

The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2016-2857

Qemu: net: out of bounds read in net_checksum_calculate()

The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-2858

Qemu: rng-random: arbitrary stack based allocation leading to corruption

QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-3710

qemu: incorrect banked access bounds checking in vga module

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Citrix Debian and 4 more
Products
Ubuntu Linux Xenserver Debian Linux and 14 more
CVE-2016-1981

Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux
CVE-2016-1922

Qemu: i386: null pointer dereference in vapic_write()

QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-1714

Qemu: nvram: OOB r/w access in processing firmware configurations

The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.

CVSS 3.0 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Oracle Qemu Redhat
Products
Linux Qemu Enterprise Linux and 1 more
CVE-2016-5338

Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO

The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-1568

Qemu: ide: ahci use-after-free vulnerability in aio port commands

Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2014-0150

qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function

Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2016-7423

Qemu: scsi: mptsas: OOB access when freeing MPTSASRequest object

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-7907

Qemu: net: inifinte loop in imx_fec_do_tx() function

The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2015-8818

Qemu: OOB access in address_space_rw leads to segmentation fault

The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Openstack
CVE-2015-8817

Qemu: OOB access in address_space_rw leads to segmentation fault

QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Openstack
CVE-2015-8745

Qemu: net: vmxnet3: reading IMR registers leads to a crash via assert(2) call

QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2015-8744

Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash via assert(2) call

QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2013-6399

qemu: virtio: buffer overrun on incoming migration

Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2011-4111

qemu: ccid: buffer overflow in handling of VSC_ATR message

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

CVSS 2.0 · 6.8 Medium EPSS 2.3% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Server Supplementary