What is the severity of CVE-2016-4952?

CVE-2016-4952 has a severity rating of medium due to its potential to cause a denial of service.

How do I fix CVE-2016-4952?

To fix CVE-2016-4952, you should update QEMU to a version newer than 2.6.2 or apply any relevant patches provided by your distribution.

Who is affected by CVE-2016-4952?

CVE-2016-4952 affects QEMU versions up to and including 2.6.2 when built with VMWARE PVSCSI paravirtual SCSI bus emulation support.

What type of vulnerability is CVE-2016-4952?

CVE-2016-4952 is a denial of service vulnerability caused by an out-of-bounds array access.

What products are involved in CVE-2016-4952?

CVE-2016-4952 impacts QEMU as well as specific versions of Ubuntu Linux and Debian Linux that utilize QEMU with the mentioned configurations.

Vulnerability/
CVE-2016-4952

medium

CWE

787

9/5/2016

2/9/2016

6/8/2024

CVE-2016-4952

First published: Mon May 09 2016(Updated: )

QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
QEMU KVM	<=2.6.2
Ubuntu Linux	=12.04
Ubuntu Linux	=14.04
Ubuntu Linux	=16.04
Debian Debian Linux	=8.0

Remedy

https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03774.html

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2016-4952?
CVE-2016-4952 has a severity rating of medium due to its potential to cause a denial of service.
How do I fix CVE-2016-4952?
To fix CVE-2016-4952, you should update QEMU to a version newer than 2.6.2 or apply any relevant patches provided by your distribution.
Who is affected by CVE-2016-4952?
CVE-2016-4952 affects QEMU versions up to and including 2.6.2 when built with VMWARE PVSCSI paravirtual SCSI bus emulation support.
What type of vulnerability is CVE-2016-4952?
CVE-2016-4952 is a denial of service vulnerability caused by an out-of-bounds array access.
What products are involved in CVE-2016-4952?
CVE-2016-4952 impacts QEMU as well as specific versions of Ubuntu Linux and Debian Linux that utilize QEMU with the mentioned configurations.

agent/type
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/author
agent/weakness
agent/last-modified-date
agent/references
agent/severity
agent/remedy
agent/event
agent/description
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2016-4952
agent/trending
agent/source
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/qemu
canonical/qemu kvm
version/qemu kvm/2.6.2
vendor/canonical
canonical/ubuntu linux
version/ubuntu linux/12.04
version/ubuntu linux/14.04
version/ubuntu linux/16.04
vendor/debian
canonical/debian debian linux
version/debian debian linux/8.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2016-4952?
CVE-2016-4952 has a severity rating of medium due to its potential to cause a denial of service.
How do I fix CVE-2016-4952?
To fix CVE-2016-4952, you should update QEMU to a version newer than 2.6.2 or apply any relevant patches provided by your distribution.
Who is affected by CVE-2016-4952?
CVE-2016-4952 affects QEMU versions up to and including 2.6.2 when built with VMWARE PVSCSI paravirtual SCSI bus emulation support.
What type of vulnerability is CVE-2016-4952?
CVE-2016-4952 is a denial of service vulnerability caused by an out-of-bounds array access.
What products are involved in CVE-2016-4952?
CVE-2016-4952 impacts QEMU as well as specific versions of Ubuntu Linux and Debian Linux that utilize QEMU with the mentioned configurations.