CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Qemu : Security Vulnerabilities (CVSS score between 1 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-4375 399 DoS 2014-01-19 2017-01-07
2.7
None Local Network Low ??? None None Partial
The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.
2 CVE-2015-6815 835 DoS 2020-01-31 2021-11-30
2.7
None Local Network Low ??? None None Partial
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
3 CVE-2018-19665 190 Mem. Corr. 2018-12-06 2020-12-14
2.7
None Local Network Low ??? None None Partial
The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
4 CVE-2019-20382 401 2020-03-05 2020-07-26
2.7
None Local Network Low ??? None None Partial
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
5 CVE-2013-4377 399 DoS 2013-10-11 2014-03-06
2.3
None Local Network Medium ??? None None Partial
Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.
6 CVE-2007-1322 2007-05-02 2020-12-15
2.1
None Local Low Not required None None Partial
QEMU 0.8.2 allows local users to halt a virtual machine by executing the icebp instruction.
7 CVE-2007-1366 2007-05-02 2020-12-15
2.1
None Local Low Not required None None Partial
QEMU 0.8.2 allows local users to crash a virtual machine via the divisor operand to the aam instruction, as demonstrated by "aam 0x0," which triggers a divide-by-zero error.
8 CVE-2008-1945 2008-08-08 2020-12-16
2.1
None Local Low Not required Partial None None
QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
9 CVE-2011-2527 264 2012-06-21 2020-11-02
2.1
None Local Low Not required Partial None None
The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
10 CVE-2014-0142 369 DoS 2017-08-10 2017-11-04
2.1
None Local Low Not required None None Partial
QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.
11 CVE-2014-3471 416 DoS 2018-01-12 2018-01-31
2.1
None Local Low Not required None None Partial
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
12 CVE-2014-3615 200 +Info 2014-11-01 2020-08-11
2.1
None Local Low Not required Partial None None
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
13 CVE-2014-3640 476 DoS 2014-11-07 2017-11-04
2.1
None Local Low Not required None None Partial
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
14 CVE-2015-5158 787 DoS Overflow 2016-04-12 2020-09-08
2.1
None Local Low Not required None None Partial
Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.
15 CVE-2015-7549 476 DoS 2017-10-30 2017-11-21
2.1
None Local Low Not required None None Partial
The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.
16 CVE-2015-8345 399 DoS 2017-04-13 2020-12-14
2.1
None Local Low Not required None None Partial
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
17 CVE-2015-8701 193 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.
18 CVE-2015-8744 20 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
19 CVE-2015-8745 617 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
20 CVE-2015-8817 125 2016-12-29 2018-01-05
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
21 CVE-2015-8818 DoS 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
22 CVE-2016-1922 476 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.
23 CVE-2016-1981 835 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.
24 CVE-2016-2197 476 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS.
25 CVE-2016-2198 476 2016-12-29 2020-11-10
2.1
None Local Low Not required None None Partial
QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.
26 CVE-2016-2391 476 DoS 2016-06-16 2020-10-15
2.1
None Local Low Not required None None Partial
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
27 CVE-2016-2392 DoS 2016-06-16 2018-12-01
2.1
None Local Low Not required None None Partial
The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
28 CVE-2016-2841 20 DoS 2016-06-16 2018-12-01
2.1
None Local Low Not required None None Partial
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.
29 CVE-2016-3712 190 DoS Overflow 2016-05-11 2020-05-14
2.1
None Local Low Not required None None Partial
Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.
30 CVE-2016-4020 +Info 2016-05-25 2021-08-04
2.1
None Local Low Not required Partial None None
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
31 CVE-2016-4441 119 DoS Overflow 2016-05-20 2020-05-14
2.1
None Local Low Not required None None Partial
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.
32 CVE-2016-5238 787 DoS 2016-06-14 2020-10-21
2.1
None Local Low Not required None None Partial
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
33 CVE-2016-5337 +Info 2016-06-14 2020-10-15
2.1
None Local Low Not required Partial None None
The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
34 CVE-2016-6490 120 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.
35 CVE-2016-6833 416 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
36 CVE-2016-6834 120 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.
37 CVE-2016-6835 DoS 2016-12-10 2020-10-19
2.1
None Local Low Not required None None Partial
The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.
38 CVE-2016-6836 665 +Info 2016-12-10 2020-10-15
2.1
None Local Low Not required Partial None None
The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.
39 CVE-2016-6888 190 DoS Overflow 2016-12-10 2021-08-04
2.1
None Local Low Not required None None Partial
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
40 CVE-2016-7116 22 Dir. Trav. 2016-12-10 2020-10-15
2.1
None Local Low Not required Partial None None
Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
41 CVE-2016-7155 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.
42 CVE-2016-7156 704 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
43 CVE-2016-7157 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.
44 CVE-2016-7170 129 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
45 CVE-2016-7421 834 DoS 2016-12-10 2020-10-15
2.1
None Local Low Not required None None Partial
The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.
46 CVE-2016-7422 120 DoS 2016-12-10 2021-08-04
2.1
None Local Low Not required None None Partial
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.
47 CVE-2016-7423 DoS 2016-10-10 2020-10-15
2.1
None Local Low Not required None None Partial
The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.
48 CVE-2016-7907 20 DoS 2016-10-05 2020-11-10
2.1
None Local Low Not required None None Partial
The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
49 CVE-2016-7908 835 DoS 2016-10-05 2020-11-10
2.1
None Local Low Not required None None Partial
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
50 CVE-2016-7994 772 DoS 2016-12-10 2020-10-21
2.1
None Local Low Not required None None Partial
Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
Total number of vulnerabilities : 166   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.