Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2016-9907

Qemu: usb: redirector: memory leakage when destroying redirector

Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 2 more
CVE-2013-4533

qemu: pxa2xx: buffer overrun on incoming migration

Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2015-5225

Qemu: ui: vnc: heap memory corruption in vnc_refresh_server_surface

Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Enterprise Linux and 1 more
CVE-2016-9106

Qemu: 9pfs: memory leakage in v9fs_write

Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-8578

Qemu: 9pfs: potential NULL dereferencein 9pfs routines

The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-8577

Qemu: 9pfs: host memory leakage in v9fs_read

Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2015-5158

Qemu: scsi stack buffer overflow

Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-8576

Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch

The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 3 more
CVE-2016-7995

Qemu: usb: hcd-ehci: memory leak in ehci_process_itd

Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu
Products
Leap Qemu
CVE-2015-5154

qemu: ide: atapi: heap overflow during I/O buffer memory access

Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat and 2 more
Products
Fedora Qemu Enterprise Linux and 7 more
CVE-2016-8667

Qemu: hw: dma: divide by zero error in set_next_tick

The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-8668

Qemu: net: OOB buffer access in rocker switch emulation

The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu
Products
Leap Qemu
CVE-2016-8669

Qemu: char: divide by zero error in serial_update_parameters

The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 3 more
CVE-2016-8909

Qemu: audio: intel-hda: infinite loop in processing dma buffer stream

The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 3 more
CVE-2016-9908

Qemu: display: virtio-gpu: information leakage in virgl_cmd_get_capset

Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2016-7994

Qemu: virtio-gpu: memory leak in virtio_gpu_resource_create_2d

Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu
Products
Leap Qemu
CVE-2016-9102

Qemu: 9pfs: memory leakage when creating extended attribute

Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-9103

Qemu: 9pfs: information leakage via xattr

The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2016-9104

Qemu: 9pfs: integer overflow leading to OOB access

Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu
Products
Debian Linux Leap Qemu
CVE-2016-7909

Qemu: net: pcnet: infinite loop in pcnet_rdra_addr()

The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu