Qemu vulnerabilities, page 3

416 vulnerabilities

Known vulnerabilities in Qemu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

2.3LowCVE-2013-4377debian · qemu +2 moredebian qemuUse-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.EPSS0.46%7.5HighCVE-2013-4540debian · qemu +3 moredebian qemuBuffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.EPSS4.55%7.5HighCVE-2013-4541debian · qemu +2 moredebian qemuThe usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.EPSS3.98%7.2HighCVE-2013-4344canonical · ubuntu_linux +19 morecanonical ubuntu_linuxBuffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.EPSS0.43%7.5HighCVE-2013-4149debian · qemu +2 moredebian qemuBuffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.EPSS5.26%7.5HighCVE-2013-4530debian · qemu +2 moredebian qemuBuffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.EPSS5.23%7.5HighCVE-2013-4527debian · qemu +2 moredebian qemuBuffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.EPSS5.26%7.8HighCVE-2013-4532canonical · ubuntu_linux +4 morecanonical ubuntu_linuxQemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.EPSS0.46%7.5HighCVE-2013-4526debian · qemu +2 moredebian qemuBuffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.EPSS4.14%7.5HighCVE-2013-4533debian · qemu +2 moredebian qemuBuffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.EPSS4.12%7.8HighCVE-2013-4536debian · qemu +2 moredebian qemuAn user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.EPSS0.30%7.5HighCVE-2013-4538debian · qemu +2 moredebian qemuMultiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.EPSS4.06%7.5HighCVE-2013-6399debian · qemu +2 moredebian qemuArray index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.EPSS3.87%3.2LowCVE-2021-20203debian · qemu +4 moredebian qemuAn integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.EPSS0.59%6.5MediumCVE-2021-20196debian · qemu +244 moredebian qemuA NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.EPSS0.48%7.5HighCVE-2021-20181debian · qemu +3 moredebian qemuA race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.EPSS0.33%3.3LowCVE-2021-20263debian · qemu +1 moredebian qemuA flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.EPSS0.38%6MediumCVE-2021-20221debian · qemu +232 moredebian qemuAn out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.EPSS0.33%6.5MediumCVE-2021-20295qemu +198 moreqemu qemuIt was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756, refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.EPSS0.30%6.5MediumCVE-2021-20257debian · qemu +9 moredebian qemuAn infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.EPSS0.37%