Most severe vulnerabilities for "qemu"

Where

Sort:

Qemu QemuRace Condition

Risk 87

Severity

Race Condition

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.

First published (updated )

CVE-2015-8556

Qemu QemuBuffer Overflow

Risk 87

Severity

Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.

First published (updated )

CVE-2016-7161

Qemu QemuCommand Injection, OS Command Injection

Risk 87

Severity

Command Injection, OS Command Injection

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

DISPUTED The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue.

1 / 2

First published (updated )

CVE-2019-12928

Qemu QemuCommand Injection, OS Command Injection

Risk 87

Severity

Command Injection, OS Command Injection

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

DISPUTED The QMP guestexec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue.

1 / 2

First published (updated )

CVE-2019-12929

Qemu QemuNull Pointer Dereference

Risk 87

Severity

Null Pointer Dereference

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS.

1 / 2

First published (updated )

CVE-2022-36648

redhat/qemuBuffer Overflow

Risk 82

Severity

9.9

Buffer Overflow

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

1 / 2

Source: MITRE

First published (updated )

CVE-2016-9603

redhat/kvmUse After Free, Double Free

Risk 82

Severity

9.9

Use After Free, Double Free

AV:N/AC:M/Au:S/C:C/I:C/A:C

+++ This bug was initially created as a clone of Bug #505640 +++

Description of problem: I was attempting the implement the client side of QEMU's VNC extension for capturing audio streams. In doing so I typo'd and sent a uint8t instead of a uint16t for one of the fields. QEMU noticed the bogus data, printed a message and then crashed with double-free memory corruption. It is trivially reproduceable and allows a remote client to crash any QEMU instance running VNC I'm not sure whether this has security implications or not, so marked this bug security sensitive.

Version-Release number of selected component (if applicable): qemu-0.10-16.fc11

How reproducible: Always

Steps to Reproduce: 1. Run QEMU with

/usr/bin/qemu -cdrom boot.iso -soundhw ac97 -vnc :5

2. Take a regular VNC client and modify its code to... 3. Send server a SetEncodings message including psuedo-encoding -259 4. Wait for server to send back a framebuffer update with encoding -259 5. Send the following 3 bytes to the server

255 1 0

Actual results: The server will now crash Invalid audio message 1 Msg: 1 glibc detected /usr/bin/qemu: double Missing separate debuginfo for /lib64/libgccs.so Try: yum --enablerepo='-debuginfo' ======= Backtrace: ========= /lib64/libc.so.6[0x33b0075a26] /usr/bin/qemu[0x496c83] /usr/bin/qemu[0x4983da] /usr/bin/qemu[0x496e8b] /usr/bin/qemu[0x409572] /usr/bin/qemu[0x40c59a] /lib64/libc.so.6(libcstartmain+0xfd)[0x33b001ea2 /usr/bin/qemu[0x406e39] ======= Memory map: ======== 00400000-005bc000 r-xp 00000000 fd:00 426968 007bc000-007c1000 rw-p 001bc000 fd:00 426968 007c1000-00b99000 rw-p 007c1000 00:00 0 00b99000-00b9a000 rwxp 00b99000 00:00 0 00b9a000-00bb0000 rw-p 00b9a000 00:00 0 00f68000-010bf000 rw-p 00f68000 00:00 0 41bfc000-440fc000 rwxp 41bfc000 00:00 0 33afc00000-33afc1f000 r-xp 00000000 fd:00 408034 33afe1e000-33afe1f000 r--p 0001e000 fd:00 408034 33afe1f000-33afe20000 rw-p 0001f000 fd:00 408034 33b0000000-33b0164000 r-xp 00000000 fd:00 408128 33b0164000-33b0364000 ---p 00164000 fd:00 408128 33b0364000-33b0368000 r--p 00164000 fd:00 408128 33b0368000-33b0369000 rw-p 00168000 fd:00 408128 33b0369000-33b036e000 rw-p 33b0369000 00:00 0 33b0400000-33b0482000 r-xp 00000000 fd:00 844388 33b0482000-33b0682000 ---p 00082000 fd:00 844388 33b0682000-33b0683000 r--p 00082000 fd:00 844388 33b0683000-33b0684000 rw-p 00083000 fd:00 844388 33b0800000-33b0802000 r-xp 00000000 fd:00 844364 33b0802000-33b0a02000 ---p 00002000 fd:00 844364 33b0a02000-33b0a03000 r--p 00002000 fd:00 844364 33b0a03000-33b0a04000 rw-p 00003000 fd:00 844364 33b0c00000-33b0c17000 r-xp 00000000 fd:00 844472 33b0c17000-33b0e16000 ---p 00017000 fd:00 844472 33b0e16000-33b0e17000 r--p 00016000 fd:00 844472 33b0e17000-33b0e18000 rw-p 00017000 fd:00 844472 33b0e18000-33b0e1c000 rw-p 33b0e18000 00:00 0 33b1000000-33b1015000 r-xp 00000000 fd:00 956376 33b1015000-33b1214000 ---p 00015000 fd:00 956376 33b1214000-33b1215000 rw-p 00014000 fd:00 956376 33b1400000-33b1407000 r-xp 00000000 fd:00 844474 33b1407000-33b1606000 ---p 00007000 fd:00 844474 33b1606000-33b1607000 r--p 00006000 fd:00 844474 33b1607000-33b1608000 rw-p 00007000 fd:00 844474 33b1800000-33b181c000 r-xp 00000000 fd:00 408070 33b181c000-33b1a1b000 ---p 0001c000 fd:00 408070 33b1a1b000-33b1a1c000 r--p 0001b000 fd:00 408070 33b1a1c000-33b1a1d000 rw-p 0001c000 fd:00 408070 33b1a1d000-33b1a1e000 rw-p 33b1a1d000 00:00 0 33b2000000-33b206b000 r-xp 00000000 fd:00 163003 33b206b000-33b226a000 ---p 0006b000 fd:00 163003 33b226a000-33b226d000 rw-p 0006a000 fd:00 163003 33b226d000-33b229d000 rw-p 33b226d000 00:00 0 33b2800000-33b2804000 r-xp 00000000 fd:00 844273 33b2804000-33b2a03000 ---p 00004000 fd:00 844273 33b2a03000-33b2a04000 rw-p 00003000 fd:00 844273 33b2c00000-33b2c02000 r-xp 00000000 fd:00 427455 33b2c02000-33b2e01000 ---p 00002000 fd:00 427455 33b2e01000-33b2e02000 rw-p 00001000 fd:00 427455 33b3000000-33b301a000 r-xp 00000000 fd:00 430096 33b301a000-33b321a000 ---p 0001a000 fd:00 430096 33b321a000-33b321b000 rw-p 0001a000 fd:00 430096 33b3400000-33b343d000 r-xp 00000000 fd:00 844324 33b343d000-33b363c000 ---p 0003d000 fd:00 844324 33b363c000-33b363d000 r--p 0003c000 fd:00 844324 33b363d000-33b363e000 rw-p 0003d000 fd:00 844324 33b3800000-33b3935000 r-xp 00000000 fd:00 430236 33b3935000-33b3b35000 ---p 00135000 fd:00 430236 33b3b35000-33b3b3b000 rw-p 00135000 fd:00 430236 33b4400000-33b4411000 r-xp 00000000 fd:00 429607 33b4411000-33b4611000 ---p 00011000 fd:00 429607 33b4611000-33b4612000 rw-p 00011000 fd:00 429607 33b5c00000-33b5c15000 r-xp 00000000 fd:00 956393 33b5c15000-33b5e15000 ---p 00015000 fd:00 956393 33b5e15000-33b5e16000 r--p 00015000 fd:00 956393 33b5e16000-33b5e17000 rw-p 00016000 fd:00 956393 33b5e17000-33b5e19000 rw-p 33b5e17000 00:00 0 33b6000000-33b6003000 r-xp 00000000 fd:00 864380 33b6003000-33b6203000 ---p 00003000 fd:00 864380 33b6203000-33b6204000 rw-p 00003000 fd:00 864380 33b8400000-33b8419000 r-xp 00000000 fd:00 956383 33b8419000-33b8619000 ---p 00019000 fd:00 956383 33b8619000-33b861a000 rw-p 00019000 fd:00 956383 33ba400000-33ba407000 r-xp 00000000 fd:00 161524 33ba407000-33ba607000 ---p 00007000 fd:00 161524 33ba607000-33ba608000 rw-p 00007000 fd:00 161524 33bac00000-33bac17000 r-xp 00000000 fd:00 158488 33bac17000-33bae17000 ---p 00017000 fd:00 158488 33bae17000-33bae18000 rw-p 00017000 fd:00 158488 33bae18000-33bae1c000 rw-p 33bae18000 00:00 0 33bc200000-33bc206000 r-xp 00000000 fd:00 431351 33bc206000-33bc405000 ---p 00006000 fd:00 431351 33bc405000-33bc406000 rw-p 00005000 fd:00 431351 33bc600000-33bc608000 r-xp 00000000 fd:00 844403 33bc608000-33bc807000 ---p 00008000 fd:00 844403 33bc807000-33bc809000 rw-p 00007000 fd:00 844403 33bca00000-33bca0e000 r-xp 00000000 fd:00 425528 33bca0e000-33bcc0e000 ---p 0000e000 fd:00 425528 33bcc0e000-33bcc0f000 rw-p 0000e000 fd:00 425528 33bce00000-33bce05000 r-xp 00000000 fd:00 155202 33bce05000-33bd004000 ---p 00005000 fd:00 155202 33bd004000-33bd005000 rw-p 00004000 fd:00 155202 33bd200000-33bd259000 r-xp 00000000 fd:00 158446 33bd259000-33bd458000 ---p 00059000 fd:00 158446 33bd458000-33bd45a000 rw-p 00058000 fd:00 158446 33bd600000-33bd647000 r-xp 00000000 fd:00 427502 33bd647000-33bd847000 ---p 00047000 fd:00 427502 33bd847000-33bd849000 rw-p 00047000 fd:00 427502 33bda00000-33bda2b000 r-xp 00000000 fd:00 162798 33bda2b000-33bdc2a000 ---p 0002b000 fd:00 162798 33bdc2a000-33bdc2c000 rw-p 0002a000 fd:00 162798 33be600000-33be64b000 r-xp 00000000 fd:00 163001 33be64b000-33be84a000 ---p 0004b000 fd:00 163001 33be84a000-33be851000 rw-p 0004a000 fd:00 163001 33bea00000-33bea02000 r-xp 00000000 fd:00 956398 33bea02000-33bec01000 ---p 00002000 fd:00 956398 33bec01000-33bec02000 r--p 00001000 fd:00 956398 33bec02000-33bec03000 rw-p 00002000 fd:00 956398 33bee00000-33bef5d000 r-xp 00000000 fd:00 163000 33bef5d000-33bf15c000 ---p 0015d000 fd:00 163000 33bf15c000-33bf182000 rw-p 0015c000 fd:00 163000 33bf182000-33bf186000 rw-p 33bf182000 00:00 0 33bf200000-33bf203000 r-xp 00000000 fd:00 956396 33bf203000-33bf402000 ---p 00003000 fd:00 956396 33bf402000-33bf403000 rw-p 00002000 fd:00 956396 33bfa00000-33bfa70000 r-xp 00000000 fd:00 956397 33bfa70000-33bfc6f000 ---p 00070000 fd:00 956397 33bfc6f000-33bfc73000 rw-p 0006f000 fd:00 956397 33c1a00000-33c1a16000 r-xp 00000000 fd:00 844339 33c1a16000-33c1c16000 ---p 00016000 fd:00 844339 33c1c16000-33c1c17000 r--p 00016000 fd:00 844339 33c1c17000-33c1c18000 rw-p 00017000 fd:00 844339 33c1c18000-33c1c1a000 rw-p 33c1c18000 00:00 0 33c1e00000-33c1e05000 r-xp 00000000 fd:00 425807 33c1e05000-33c2005000 ---p 00005000 fd:00 425807 33c2005000-33c2006000 rw-p 00005000 fd:00 425807 33c2600000-33c269f000 r-xp 00000000 fd:00 163002 33c269f000-33c289f000 ---p 0009f000 fd:00 163002 33c289f000-33c28aa000 rw-p 0009f000 fd:00 163002 33c2a00000-33c2a10000 r-xp 00000000 fd:00 430214 33c2a10000-33c2c10000 ---p 00010000 fd:00 430214 33c2c10000-33c2c11000 rw-p 00010000 fd:00 430214 33c6a00000-33c6add000 r-xp 00000000 fd:00 956395 33c6add000-33c6cdc000 ---p 000dd000 fd:00 956395 33c6cdc000-33c6ce4000 rw-p 000dc000 fd:00 956395 37f1a00000-37f1a19000 r-xp 00000000 fd:00 157602 37f1a19000-37f1c19000 ---p 00019000 fd:00 157602 37f1c19000-37f1c1a000 rw-p 00019000 fd:00 157602 7f64fc000000-7f64fc021000 rw-p 7f64fc000000 7f64fc021000-7f6500000000 ---p 7f64fc021000 7f6501a03000-7f6501a04000 ---p 7f6501a03000 7f6501a04000-7f6502404000 rw-p 7f6501a04000 7f6503158000-7f6503159000 rw-p 7f6503158000 7f6503286000-7f6503327000 rw-p 7f6503286000 7f6503327000-7f650332a000 r-xp 00000000 fd:00 429437 7f650332a000-7f6503529000 ---p 00003000 fd:00 429437 7f6503529000-7f650352a000 rw-p 00002000 fd:00 429437 7f650352a000-7f6503544000 r-xp 00000000 fd:00 425581 7f6503544000-7f6503744000 ---p 0001a000 fd:00 425581 7f6503744000-7f6503746000 rw-p 0001a000 fd:00 425581 7f6503746000-7f650374b000 rw-p 7f6503746000 7f650374b000-7f6503751000 r-xp 00000000 fd:00 449066 7f6503751000-7f6503950000 ---p 00006000 fd:00 449066 7f6503950000-7f6503951000 rw-p 00005000 fd:00 449066 7f6503951000-7f6503955000 r-xp 00000000 fd:00 450859 7f6503955000-7f6503b55000 ---p 00004000 fd:00 450859 7f6503b55000-7f6503b56000 rw-p 00004000 fd:00 450859 7f6503b56000-7f6503b9a000 r-xp 00000000 fd:00 161564 7f6503b9a000-7f6503d99000 ---p 00044000 fd:00 161564 7f6503d99000-7f6503d9c000 rw-p 00043000 fd:00 161564 7f6503d9c000-7f6503da0000 r-xp 00000000 fd:00 449078 7f6503da0000-7f6503f9f000 ---p 00004000 fd:00 449078 7f6503f9f000-7f6503fa0000 rw-p 00003000 fd:00 449078 7f6503fa0000-7f6503fa7000 r-xp 00000000 fd:00 449069 7f6503fa7000-7f65041a6000 ---p 00007000 fd:00 449069 7f65041a6000-7f65041a7000 rw-p 00006000 fd:00 449069 7f65041a7000-7f65041ab000 r-xp 00000000 fd:00 450474 7f65041ab000-7f65043aa000 ---p 00004000 fd:00 450474 7f65043aa000-7f65043ab000 rw-p 00003000 fd:00 450474 7f65043ab000-7f65043b3000 r-xp 00000000 fd:00 449072 7f65043b3000-7f65045b2000 ---p 00008000 fd:00 449072 7f65045b2000-7f65045b3000 rw-p 00007000 fd:00 449072 7f65045b3000-7f65045b7000 r-xp 00000000 fd:00 450471 7f65045b7000-7f65047b6000 ---p 00004000 fd:00 450471 7f65047b6000-7f65047b7000 rw-p 00003000 fd:00 450471 7f65047b7000-7f65047b9000 r-xp 00000000 fd:00 956392 7f65047b9000-7f65049b8000 ---p 00002000 fd:00 956392 7f65049b8000-7f65049b9000 rw-p 00001000 fd:00 956392 7f65049b9000-7f65049c2000 r-xp 00000000 fd:00 430940 7f65049c2000-7f6504bc1000 ---p 00009000 fd:00 430940 7f6504bc1000-7f6504bc2000 rw-p 00008000 fd:00 430940 7f6504bc2000-7f6504be6000 r-xp 00000000 fd:00 162060 7f6504be6000-7f6504de6000 ---p 00024000 fd:00 162060 7f6504de6000-7f6504de8000 rw-p 00024000 fd:00 162060 7f6504de8000-7f6504e31000 r-xp 00000000 fd:00 161566 7f6504e31000-7f6505031000 ---p 00049000 fd:00 161566 7f6505031000-7f6505034000 rw-p 00049000 fd:00 161566 7f6505034000-7f6505037000 rw-p 7f6505034000 7f6505037000-7f650503a000 r-xp 00000000 fd:00 956394 7f650503a000-7f6505239000 ---p 00003000 fd:00 956394 7f6505239000-7f650523a000 rw-p 00002000 fd:00 956394 7f650523a000-7f65052d5000 r-xp 00000000 fd:00 162171 7f65052d5000-7f65054d5000 ---p 0009b000 fd:00 162171 7f65054d5000-7f65054d9000 rw-p 0009b000 fd:00 162171 7f65054d9000-7f65054fb000 r-xp 00000000 fd:00 161620 7f65054fb000-7f65056fb000 ---p 00022000 fd:00 161620 7f65056fb000-7f65056fd000 rw-p 00022000 fd:00 161620 7f65056fd000-7f6505831000 r-xp 00000000 fd:00 2744066 7f6505831000-7f6505a30000 ---p 00134000 fd:00 2744066 7f6505a30000-7f6505a7d000 rw-p 00133000 fd:00 2744066 7f6505a7d000-7f6505a7e000 rw-p 7f6505a7d000 7f6505a7e000-7f6505a84000 r-xp 00000000 fd:00 449075 7f6505a84000-7f6505c83000 ---p 00006000 fd:00 449075 7f6505c83000-7f6505c84000 rw-p 00005000 fd:00 449075 7f6505c84000-7f6505c88000 r-xp 00000000 fd:00 450216 7f6505c88000-7f6505e87000 ---p 00004000 fd:00 450216 7f6505e87000-7f6505e88000 rw-p 00003000 fd:00 450216 7f6505e88000-7f6505e94000 r-xp 00000000 fd:00 450862 7f6505e94000-7f6506093000 ---p 0000c000 fd:00 450862 7f6506093000-7f6506094000 rw-p 0000b000 fd:00 450862 7f6506094000-7f6506201000 r-xp 00000000 fd:00 844471 7f6506201000-7f6506400000 ---p 0016d000 fd:00 844471 7f6506400000-7f6506406000 rw-p 0016c000 fd:00 844471 7f6506406000-7f650640b000 r-xp 00000000 fd:00 450219 7f650640b000-7f650660a000 ---p 00005000 fd:00 450219 7f650660a000-7f650660b000 rw-p 00004000 fd:00 450219 7f650660b000-7f650660f000 r-xp 00000000 fd:00 844251 7f650660f000-7f650680e000 ---p 00004000 fd:00 844251 7f650680e000-7f650680f000 rw-p 00003000 fd:00 844251 7f650680f000-7f6506813000 r-xp 00000000 fd:00 430687 7f6506813000-7f6506a12000 ---p 00004000 fd:00 430687 7f6506a12000-7f6506a13000 rw-p 00003000 fd:00 430687 7f6506a2d000-7f65120e2000 rw-p 7f6506a2d000 7f65120e2000-7f65120e7000 r-xp 00000000 fd:00 958096 7f65120e7000-7f65122e6000 ---p 00005000 fd:00 958096 7f65122e6000-7f65122e7000 r--p 00004000 fd:00 958096 7f65122e7000-7f65122e8000 rw-p 00005000 fd:00 958096 7f65122e8000-7f65122f4000 r-xp 00000000 fd:00 958097 7f65122f4000-7f65124f3000 ---p 0000c000 fd:00 958097 7f65124f3000-7f65124f4000 r--p 0000b000 fd:00 958097 7f65124f4000-7f65124f5000 rw-p 0000c000 fd:00 958097 7f65124f5000-7f65124f8000 rw-p 7f65124f5000 7f65124f8000-7f6512551000 r-xp 00000000 fd:00 957313 7f6512551000-7f6512750000 ---p 00059000 fd:00 957313 7f6512750000-7f6512751000 rw-p 00058000 fd:00 957313 7f6512751000-7f6512757000 rw-p 7f6512751000 7f6512757000-7f651275f000 r-xp 00000000 fd:00 957069 7f651275f000-7f651295e000 ---p 00008000 fd:00 957069 7f651295e000-7f651295f000 r--p 00007000 fd:00 957069 7f651295f000-7f6512960000 rw-p 00008000 fd:00 957069 7f6512960000-7f6512993000 rw-p 7f6512960000 7f65129a6000-7f65129ad000 r--s 00000000 fd:00 472373 7f65129ad000-7f65129af000 rw-p 7f65129ad000 7fff1a999000-7fff1a9ae000 rw-p 7ffffffea000 00:00 0 7fff1a9fe000-7fff1a9ff000 r-xp 7fff1a9fe000 00:00 0 ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 free or corruption (out): 0x000000000109e4a0 .1 install /usr/lib/debug/.build-id/2d/71efecf2876da5ca07c3b5acf28fe281c96942.debug d] /usr/bin/qemu /usr/bin/qemu [heap] /lib64/ld-2.10.1.so /lib64/ld-2.10.1.so /lib64/ld-2.10.1.so /lib64/libc-2.10.1.so /lib64/libc-2.10.1.so /lib64/libc-2.10.1.so /lib64/libc-2.10.1.so /lib64/libm-2.10.1.so /lib64/libm-2.10.1.so /lib64/libm-2.10.1.so /lib64/libm-2.10.1.so /lib64/libdl-2.10.1.so /lib64/libdl-2.10.1.so /lib64/libdl-2.10.1.so /lib64/libdl-2.10.1.so /lib64/libpthread-2.10.1.so /lib64/libpthread-2.10.1.so /lib64/libpthread-2.10.1.so /lib64/libpthread-2.10.1.so /lib64/libz.so.1.2.3 /lib64/libz.so.1.2.3 /lib64/libz.so.1.2.3 /lib64/librt-2.10.1.so /lib64/librt-2.10.1.so /lib64/librt-2.10.1.so /lib64/librt-2.10.1.so /lib64/libselinux.so.1 /lib64/libselinux.so.1 /lib64/libselinux.so.1 /lib64/libselinux.so.1 /usr/lib64/libSDL-1.2.so.0.11.2 /usr/lib64/libSDL-1.2.so.0.11.2 /usr/lib64/libSDL-1.2.so.0.11.2 /lib64/libcap.so.2.16 /lib64/libcap.so.2.16 /lib64/libcap.so.2.16 /usr/lib64/libXau.so.6.0.0 /usr/lib64/libXau.so.6.0.0 /usr/lib64/libXau.so.6.0.0 /usr/lib64/libxcb.so.1.1.0 /usr/lib64/libxcb.so.1.1.0 /usr/lib64/libxcb.so.1.1.0 /lib64/libdbus-1.so.3.4.0 /lib64/libdbus-1.so.3.4.0 /lib64/libdbus-1.so.3.4.0 /lib64/libdbus-1.so.3.4.0 /usr/lib64/libX11.so.6.2.0 /usr/lib64/libX11.so.6.2.0 /usr/lib64/libX11.so.6.2.0 /usr/lib64/libXext.so.6.4.0 /usr/lib64/libXext.so.6.4.0 /usr/lib64/libXext.so.6.4.0 /lib64/libresolv-2.10.1.so /lib64/libresolv-2.10.1.so /lib64/libresolv-2.10.1.so /lib64/libresolv-2.10.1.so /lib64/libuuid.so.1.2 /lib64/libuuid.so.1.2 /lib64/libuuid.so.1.2 /lib64/libgccs-4.4.0-20090506.so.1 /lib64/libgccs-4.4.0-20090506.so.1 /lib64/libgccs-4.4.0-20090506.so.1 /usr/lib64/libSM.so.6.0.0 /usr/lib64/libSM.so.6.0.0 /usr/lib64/libSM.so.6.0.0 /usr/lib64/libICE.so.6.3.0 /usr/lib64/libICE.so.6.3.0 /usr/lib64/libICE.so.6.3.0 /usr/lib64/libgdbm.so.2.0.0 /usr/lib64/libgdbm.so.2.0.0 /usr/lib64/libgdbm.so.2.0.0 /lib64/libwrap.so.0.7.6 /lib64/libwrap.so.0.7.6 /lib64/libwrap.so.0.7.6 /usr/lib64/liblber-2.4.so.2.4.1 /usr/lib64/liblber-2.4.so.2.4.1 /usr/lib64/liblber-2.4.so.2.4.1 /usr/lib64/libasyncns.so.0.3.1 /usr/lib64/libasyncns.so.0.3.1 /usr/lib64/libasyncns.so.0.3.1 /usr/lib64/libpulsecommon-0.9.15.so /usr/lib64/libpulsecommon-0.9.15.so /usr/lib64/libpulsecommon-0.9.15.so /usr/lib64/libpulse.so.0.8.0 /usr/lib64/libpulse.so.0.8.0 /usr/lib64/libpulse.so.0.8.0 /usr/lib64/libgssapikrb5.so.2.2 /usr/lib64/libgssapikrb5.so.2.2 /usr/lib64/libgssapikrb5.so.2.2 /usr/lib64/libssl.so.0.9.8k /usr/lib64/libssl.so.0.9.8k /usr/lib64/libssl.so.0.9.8k /lib64/libutil-2.10.1.so /lib64/libutil-2.10.1.so /lib64/libutil-2.10.1.so /lib64/libutil-2.10.1.so /usr/lib64/libcrypto.so.0.9.8k /usr/lib64/libcrypto.so.0.9.8k /usr/lib64/libcrypto.so.0.9.8k /lib64/libgpg-error.so.0.4.0 /lib64/libgpg-error.so.0.4.0 /lib64/libgpg-error.so.0.4.0 /lib64/libgcrypt.so.11.5.2 /lib64/libgcrypt.so.11.5.2 /lib64/libgcrypt.so.11.5.2 /lib64/libnsl-2.10.1.so /lib64/libnsl-2.10.1.so /lib64/libnsl-2.10.1.so /lib64/libnsl-2.10.1.so /usr/lib64/libXtst.so.6.1.0 /usr/lib64/libXtst.so.6.1.0 /usr/lib64/libXtst.so.6.1.0 /usr/lib64/libgnutls.so.26.11.7 /usr/lib64/libgnutls.so.26.11.7 /usr/lib64/libgnutls.so.26.11.7 /usr/lib64/libtasn1.so.3.1.2 /usr/lib64/libtasn1.so.3.1.2 /usr/lib64/libtasn1.so.3.1.2 /lib64/libasound.so.2.0.0 /lib64/libasound.so.2.0.0 /lib64/libasound.so.2.0.0 /usr/lib64/libsasl2.so.2.0.22 /usr/lib64/libsasl2.so.2.0.22 /usr/lib64/libsasl2.so.2.0.22 00:00 0 00:00 0 00:00 0 00:00 0 00:00 0 00:00 0 /usr/lib64/libdes425.so.3.0 /usr/lib64/libdes425.so.3.0 /usr/lib64/libdes425.so.3.0 /usr/lib64/libkrb4.so.2.0 /usr/lib64/libkrb4.so.2.0 /usr/lib64/libkrb4.so.2.0 00:00 0 /usr/lib64/sasl2/libkerberos4.so.2.0.22 /usr/lib64/sasl2/libkerberos4.so.2.0.22 /usr/lib64/sasl2/libkerberos4.so.2.0.22 /usr/lib64/sasl2/libcrammd5.so.2.0.22 /usr/lib64/sasl2/libcrammd5.so.2.0.22 /usr/lib64/sasl2/libcrammd5.so.2.0.22 /usr/lib64/libldap-2.4.so.2.4.1 /usr/lib64/libldap-2.4.so.2.4.1 /usr/lib64/libldap-2.4.so.2.4.1 /usr/lib64/sasl2/libldapdb.so.2.0.22 /usr/lib64/sasl2/libldapdb.so.2.0.22 /usr/lib64/sasl2/libldapdb.so.2.0.22 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 /usr/lib64/sasl2/libplain.so.2.0.22 /usr/lib64/sasl2/libplain.so.2.0.22 /usr/lib64/sasl2/libplain.so.2.0.22 /usr/lib64/sasl2/libntlm.so.2.0.22 /usr/lib64/sasl2/libntlm.so.2.0.22 /usr/lib64/sasl2/libntlm.so.2.0.22 /usr/lib64/sasl2/liblogin.so.2.0.22 /usr/lib64/sasl2/liblogin.so.2.0.22 /usr/lib64/sasl2/liblogin.so.2.0.22 /lib64/libkeyutils-1.2.so /lib64/libkeyutils-1.2.so /lib64/libkeyutils-1.2.so /usr/lib64/libkrb5support.so.0.1 /usr/lib64/libkrb5support.so.0.1 /usr/lib64/libkrb5support.so.0.1 /usr/lib64/libk5crypto.so.3.1 /usr/lib64/libk5crypto.so.3.1 /usr/lib64/libk5crypto.so.3.1 /usr/lib64/libldapr-2.4.so.2.4.1 /usr/lib64/libldapr-2.4.so.2.4.1 /usr/lib64/libldapr-2.4.so.2.4.1 00:00 0 /lib64/libcomerr.so.2.1 /lib64/libcomerr.so.2.1 /lib64/libcomerr.so.2.1 /usr/lib64/libkrb5.so.3.3 /usr/lib64/libkrb5.so.3.3 /usr/lib64/libkrb5.so.3.3 /usr/lib64/libpq.so.5.1 /usr/lib64/libpq.so.5.1 /usr/lib64/libpq.so.5.1 /usr/lib64/mysql/libmysqlclient.so.16.0.0 /usr/lib64/mysql/libmysqlclient.so.16.0.0 /usr/lib64/mysql/libmysqlclient.so.16.0.0 00:00 0 /usr/lib64/sasl2/libsql.so.2.0.22 /usr/lib64/sasl2/libsql.so.2.0.22 /usr/lib64/sasl2/libsql.so.2.0.22 /usr/lib64/sasl2/libanonymous.so.2.0.22 /usr/lib64/sasl2/libanonymous.so.2.0.22 /usr/lib64/sasl2/libanonymous.so.2.0.22 /usr/lib64/sasl2/libdigestmd5.so.2.0.22 /usr/lib64/sasl2/libdigestmd5.so.2.0.22 /usr/lib64/sasl2/libdigestmd5.so.2.0.22 /lib64/libdb-4.7.so /lib64/libdb-4.7.so /lib64/libdb-4.7.so /usr/lib64/sasl2/libsasldb.so.2.0.22 /usr/lib64/sasl2/libsasldb.so.2.0.22 /usr/lib64/sasl2/libsasldb.so.2.0.22 /lib64/libattr.so.1.1.0 /lib64/libattr.so.1.1.0 /lib64/libattr.so.1.1.0 /usr/lib64/libpulse-simple.so.0.0.2 /usr/lib64/libpulse-simple.so.0.0.2 /usr/lib64/libpulse-simple.so.0.0.2 00:00 0 /lib64/libnssdns-2.10.1.so /lib64/libnssdns-2.10.1.so /lib64/libnssdns-2.10.1.so /lib64/libnssdns-2.10.1.so /lib64/libnssfiles-2.10.1.so /lib64/libnssfiles-2.10.1.so /lib64/libnssfiles-2.10.1.so /lib64/libnssfiles-2.10.1.so 00:00 0 /lib64/libfreebl3.so /lib64/libfreebl3.so /lib64/libfreebl3.so 00:00 0 /lib64/libcrypt-2.10.1.so /lib64/libcrypt-2.10.1.so /lib64/libcrypt-2.10.1.so /lib64/libcrypt-2.10.1.so 00:00 0 /usr/lib64/gconv/gconv-modules.cache 00:00 0 [stack] [vdso] [vsyscall]

Program received signal SIGABRT, Aborted. 0x00000033b00332f5 in raise () from /lib64/libc.so.6

(gdb) bt #0 0x00000033b00332f5 in raise () from /lib64/libc.so.6 #1 0x00000033b0034b20 in abort () from /lib64/libc.so.6 #2 0x00000033b007005d in libcmessage () from /lib64/libc.so.6 #3 0x00000033b0075a26 in mallocprinterr () from /lib64/libc.so.6 #4 0x0000000000496c83 in vncclientioerror (vs=0x1096020, ret=<value optimized out>, lasterrno=<value optimized out>) at vnc.c:870 #5 0x00000000004983da in protocolclientmsg (vs=0x1096020, data=0x109e4a0 "\1", len=<value optimized out>) at vnc.c:1729 #6 0x0000000000496e8b in vncclientread (opaque=<value optimized out>) at vnc.c:1095 #7 0x0000000000409572 in mainloopwait (timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.10/qemu/vl.c:3774 #8 0x000000000040c59a in mainloop () at /usr/src/debug/qemu-kvm-0.10/qemu/vl.c:3972 #9 main () at /usr/src/debug/qemu-kvm-0.10/qemu/vl.c:6126

Expected results: Server reports invalid message and drops the client connection

Additional info:

1 / 2

Source: Red Hat

First published (updated )

CVE-2009-3616

Qemu QemuQuick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable …

Risk 82

Severity

9.9

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrusbitbltcputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

First published (updated )

CVE-2017-2620

Qemu QemuBuffer Overflow

Risk 88

Severity

9.8

Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Buffer overflow in the mipsnetreceive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.

1 / 2

Source: MITRE

First published (updated )

CVE-2016-4002

Qemu QemuBuffer Overflow

Risk 88

Severity

9.8

Buffer Overflow

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Buffer overflow in the "megasasmmiowrite" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.

1 / 2

First published (updated )

CVE-2017-8380

Qemu QemuBuffer Overflow

Risk 82

Severity

9.3

Buffer Overflow

AV:N/AC:M/Au:N/C:C/I:C/A:C

A buffer overflow flaw was found in the way e1000 emulated device driver of QEMU, a FAST! processor emulator, processed received large e1000 packets, when the SBP and LPE flags were disabled. If the underlying network was configured to allow large (jumbo) packets, a remote attacker could use this flaw to cause relevant guest in question to crash (DoS) or, potentially, the attacker could use this flaw to execute arbitrary code on the guest system with the kernel level privilege.

References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696051 [2] http://www.openwall.com/lists/oss-security/2012/12/19/9 [3] http://thread.gmane.org/gmane.comp.emulators.qemu/182666 [4] http://www.openwall.com/lists/oss-security/2013/01/17/12

Relevant upstream patches: [5] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb http://git.qemu.org/?p=qemu.git;a=commitdiff;h=2c0331f4f7d241995452b99afaf0aab00493334a

1 / 2

Source: Red Hat

First published (updated )

CVE-2012-6075

Qemu QemuQuick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-o…

Risk 72

Severity

9.1

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

First published (updated )

CVE-2017-2615

Qemu QemuBuffer Overflow

Risk 78

Severity

Buffer Overflow

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Buffer overflow in the pcnetreceive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.

First published (updated )

CVE-2015-7512

Qemu QemuQemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A pr…

Risk 78

Severity

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.

First published (updated )

CVE-2016-9602

ubuntu/qemuAn issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrar…

Risk 76

Severity

8.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

DISPUTED An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.

1 / 4

Source: Ubuntu

First published (updated )

CVE-2020-24165

redhat/qemu-kvm-rhevBuffer Overflow

Risk 81

Severity

8.8

Buffer Overflow

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBDOPTLIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

1 / 3

First published (updated )

CVE-2017-2630

Debian Debian LinuxBuffer Overflow

Risk 72

Severity

8.8

Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Qemu emulator built with VGA emulation with VESA BIOS Extensions(VBE) support is vulnerable to an OOB r/w access issue. It could occur while doing VGA r/w operations via i/o port methods.

A privileged guest user could use this flaw to potentially execute arbitrary code, with privileges of the Qemu process on the host.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/05/09/3

1 / 2

Source: Red Hat

First published (updated )

CVE-2016-3710

Qemu QemuBuffer Overflow

Risk 72

Severity

8.8

Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Heap-based buffer overflow in the pcnetreceive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

First published (updated )

CVE-2015-7504

redhat/qemu-kvmInput Validation

Risk 75

Severity

8.8

Input Validation

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueuemapsg(), where numsg is taken from the wire and can force writes to indicies beyond VIRTQUEUEMAXSIZE.

An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

Upstream fix: ------------- -> http://git.qemu.org/?p=qemu.git;a=commit;h=36cf2a37132c7f01fa9adb5f95f5312b27742fd4

1 / 2

Source: Red Hat

First published (updated )

CVE-2013-4535

Qemu QemuUse After Free

Risk 76

Severity

8.8

Use After Free

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Last updated 24 July 2024

1 / 3

Source: Ubuntu

First published (updated )

CVE-2016-1568

Qemu QemuInteger Overflow

Risk 76

Severity

8.8

Integer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Integer overflow in the loadmultiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.

1 / 3

Source: Launchpad

First published (updated )

CVE-2017-14167

redhat/qemuUse After Free

Risk 75

Severity

8.8

Use After Free

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

1 / 2

Source: MITRE

First published (updated )

CVE-2022-1050

Qemu QemuBuffer Overflow

Risk 49

Severity

8.6

Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Buffer overflow in the stellarisenetreceive function in hw/net/stellarisenet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.

First published (updated )

CVE-2016-4001

Qemu QemuBuffer Overflow, Input Validation

Risk 73

Severity

8.6

Buffer Overflow, Input Validation

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.

1 / 2

Source: MITRE

First published (updated )

CVE-2014-0144

Qemu QemuBuffer Overflow

Risk 59

Severity

8.4

Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

The netchecksumcalculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

First published (updated )

CVE-2016-2857

Qemu QemuQEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Risk 65

Severity

8.2

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

This vulnerability allows local attackers to escalate privileges on affected installations of QEMU. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of the virtual LSI53C895A SCSI Host Bus Adapter. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor.

1 / 2

Source: ZDI

First published (updated )

Advisory

ZDI-24-1382

Qemu QemuZDI-24-1382: QEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Risk 65

Severity

8.2

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

1 / 2

Source: ZDI

First published (updated )

ZDI-CAN-23962

Qemu QemuQEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Risk 67

Severity

8.2

Use After Free

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

1 / 3

Source: MITRE

First published (updated )

CVE-2024-6519

Qemu QemuLast updated 24 July 2024

Risk 67

Severity

8.2

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.

1 / 3

Source: Launchpad

First published (updated )

CVE-2020-35517

redhat/qemu-kvmInteger Overflow, Buffer Overflow

Risk 67

Severity

8.2

Integer Overflow, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursoralloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

1 / 3

Source: Launchpad

First published (updated )

CVE-2021-4206

Trending

Versions

Qemu QemuRace Condition

Qemu QemuBuffer Overflow

Qemu QemuCommand Injection, OS Command Injection

Qemu QemuCommand Injection, OS Command Injection

Qemu QemuNull Pointer Dereference

redhat/qemuBuffer Overflow

redhat/kvmUse After Free, Double Free

Qemu QemuQuick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable …

Qemu QemuBuffer Overflow

Qemu QemuBuffer Overflow

Qemu QemuBuffer Overflow

Qemu QemuQuick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-o…

Qemu QemuBuffer Overflow

Qemu QemuQemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A pr…

ubuntu/qemuAn issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrar…

redhat/qemu-kvm-rhevBuffer Overflow

Debian Debian LinuxBuffer Overflow

Qemu QemuBuffer Overflow

redhat/qemu-kvmInput Validation

Qemu QemuUse After Free

Qemu QemuInteger Overflow

redhat/qemuUse After Free

Qemu QemuBuffer Overflow

Qemu QemuBuffer Overflow, Input Validation

Qemu QemuBuffer Overflow

Qemu QemuQEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Qemu QemuZDI-24-1382: QEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Qemu QemuQEMU SCSI Use-After-Free Local Privilege Escalation Vulnerability

Qemu QemuLast updated 24 July 2024

redhat/qemu-kvmInteger Overflow, Buffer Overflow

Company

Resources

Contact