Product:

Qemu

(Qemu)
Repositories • https://github.com/qemu/qemu
• https://github.com/bonzini/qemu
• https://github.com/torvalds/linux
#Vulnerabilities 406
Date Id Summary Products Score Patch Annotated
2018-12-20 CVE-2018-20126 hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. Ubuntu_linux, Leap, Qemu N/A
2018-12-20 CVE-2018-20125 hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings. Ubuntu_linux, Qemu N/A
2018-12-20 CVE-2018-20124 hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value. Ubuntu_linux, Qemu N/A
2018-11-02 CVE-2018-16847 An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process. Ubuntu_linux, Qemu N/A
2016-06-01 CVE-2016-4454 The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read. Ubuntu_linux, Debian_linux, Qemu N/A
2016-06-01 CVE-2016-4453 The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command. Ubuntu_linux, Debian_linux, Qemu N/A
2016-05-20 CVE-2016-4441 The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command. Ubuntu_linux, Debian_linux, Qemu N/A
2016-05-20 CVE-2016-4439 The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors. Ubuntu_linux, Debian_linux, Qemu N/A
2020-01-21 CVE-2020-7211 tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows. Libslirp, Qemu N/A
2019-12-30 CVE-2013-2016 A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host. Debian_linux, Open_desktop_server, Open_enterprise_server, Qemu N/A