Qemu vulnerabilities, page 5

416 vulnerabilities

Known vulnerabilities in Qemu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

6.5MediumCVE-2021-3611debian · qemu +5 moredebian qemuA stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.EPSS0.46%6.5MediumCVE-2021-3582debian · qemu +3 moredebian qemuA flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.EPSS0.39%5.5MediumCVE-2021-3527debian · qemu +4 moredebian qemuA flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.EPSS0.37%5.7MediumCVE-2021-3409debian · qemu +5 moredebian qemuThe patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.EPSS0.49%6.5MediumCVE-2021-3544debian · qemu +3 moredebian qemuSeveral memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.EPSS0.44%8.6HighCVE-2015-1779canonical · ubuntu_linux +29 morecanonical ubuntu_linuxThe VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.EPSS6.57%4.6MediumCVE-2015-4106canonical · ubuntu_linux +11 morecanonical ubuntu_linuxQEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.EPSS0.48%1.9LowCVE-2015-4037debian · qemu +2 moredebian qemuThe slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.EPSS0.38%6MediumCVE-2015-7549debian · qemu +2 moredebian qemuThe MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.EPSS0.39%8.8HighCVE-2015-7504debian · qemu +4 moredebian qemuHeap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.EPSS0.64%5MediumCVE-2015-7295debian · qemu +4 moredebian qemuhw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.EPSS4.80%9CriticalCVE-2015-7512debian · qemu +10 moredebian qemuBuffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.EPSS7.73%6.5MediumCVE-2015-5278arista · eos +5 morearista eosThe ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.EPSS2.28%7.2HighCVE-2015-5154debian · qemu +20 moredebian qemuHeap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.EPSS0.63%7.2HighCVE-2015-5279debian · qemu +21 moredebian qemuHeap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.EPSS1.05%6.5MediumCVE-2015-5745arista · eos +4 morearista eosBuffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.EPSS3.01%7.2HighCVE-2015-5225debian · qemu +11 moredebian qemuBuffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.EPSS0.53%5.5MediumCVE-2015-5158debian · qemu +1 moredebian qemuStack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.EPSS0.43%6.5MediumCVE-2015-5239arista · eos +9 morearista eosInteger overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.EPSS3.61%7.5HighCVE-2015-6855arista · eos +8 morearista eoshw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.EPSS3.50%