Qemu vulnerabilities, page 2

416 vulnerabilities

Known vulnerabilities in Qemu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

5.5MediumCVE-2018-18849canonical · ubuntu_linux +5 morecanonical ubuntu_linuxIn Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.EPSS0.56%5.5MediumCVE-2018-18954canonical · ubuntu_linux +4 morecanonical ubuntu_linuxThe pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.EPSS0.52%6MediumCVE-2018-5683canonical · ubuntu_linux +10 morecanonical ubuntu_linuxThe vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.EPSS0.68%6.5MediumCVE-2018-10839canonical · ubuntu_linux +5 morecanonical ubuntu_linuxQemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.EPSS3.08%5.5MediumCVE-2018-15746debian · qemu +2 moredebian qemuqemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.EPSS0.50%7.5HighCVE-2018-12617canonical · ubuntu_linux +6 morecanonical ubuntu_linuxqmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.EPSS25.05%6.9MediumCVE-2013-2007mageia · qemu +8 moremageia qemuThe qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.EPSS0.38%7.8HighCVE-2013-2016debian · qemu +5 moredebian qemuA flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.EPSS0.51%8.8HighCVE-2013-4535debian · qemu +7 moredebian qemuThe virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.EPSS0.96%7.5HighCVE-2013-4534debian · qemu +2 moredebian qemuBuffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.EPSS4.12%7.5HighCVE-2013-4542debian · qemu +2 moredebian qemuThe virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.EPSS4.95%4.9MediumCVE-2013-4544canonical · ubuntu_linux +3 morecanonical ubuntu_linuxhw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.EPSS0.72%2.7LowCVE-2013-4375debian · qemu +3 moredebian qemuThe qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.EPSS0.58%7.5HighCVE-2013-4148debian · qemu +2 moredebian qemuInteger signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.EPSS4.94%7.5HighCVE-2013-4539debian · qemu +2 moredebian qemuMultiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.EPSS4.25%7.5HighCVE-2013-4150debian · qemu +2 moredebian qemuThe virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.EPSS4.95%7.5HighCVE-2013-4151debian · qemu +2 moredebian qemuThe virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.EPSS5.13%7.5HighCVE-2013-4537debian · qemu +2 moredebian qemuThe ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.EPSS2.93%7.5HighCVE-2013-4529debian · qemu +2 moredebian qemuBuffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.EPSS3.28%7.5HighCVE-2013-4531debian · qemu +2 moredebian qemuBuffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.EPSS4.12%