CVE-2014-0145: qemu
Vulnerability summary
CVE-2014-0145 is a high (CVSS 7.8) vulnerability in qemu. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 2Timeline
- 10-08-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- qemu< 2.0.0+dfsg-1
Qemu1 product
- qemu≤ 1.7.1 | 2.0.0:rc0 | 2.0.0:rc1 | 2.0.0:rc2 | 2.0.0:rc3
Ubuntu1 product
- qemu< 2.0.0~rc1+dfsg-0ubuntu3
3 vendors · 3 products
References
14 links- lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.htmlX Refsource MISCPatchThird Party Advisory
