4.9

CVE-2014-0150: qemu Numeric Errors

CVSS: 4.9v2.0MediumModified
AliasesUBUNTU-CVE-2014-0150DEBIAN-CVE-2014-0150DSA-2909-1
Published 18-04-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-0150 is a medium (CVSS 4.9) Numeric Errors vulnerability in qemu. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.

Overall risk
20/100
0100
Low · default modelHow is this calculated?
CVSS score
4.9/10
010
Medium · v2.0 (NVD)
EPSS score
0.70%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 2
MGASA-2014-0426OPENSUSE-SU-2024:10233-1RHSA-2014:0420RHSA-2014:0421RHSA-2014:0434RHSA-2014:0435

Timeline

  1. 18-04-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.70%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

-0.01 pp

From 0.71% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • qemu< 1.7.0+dfsg-8 | < 0.12.5+dfsg-3squeeze4 | < 1.1.2+dfsg-6a+deb7u1
  • qemu-kvm< 0.12.5+dfsg-5+squeeze11 | < 1.1.2+dfsg-6+deb7u1
Qemu1 product
  • qemu≤ 2.0 | ≤ 2.0.0 | 0.1.0 | 0.1.1 | 0.1.2 | 0.1.3 | 0.1.4 | 0.1.5 | 0.1.6 | 0.2.0 | 0.3.0 | 0.4.0 | 0.4.1 | 0.4.2 | 0.4.3 | 0.5.0 | 0.5.1 | 0.5.2 | 0.5.3 | 0.5.4 | 0.5.5 | 0.6.0 | 0.6.1 | 0.7.0 | 0.7.1 | 0.7.2 | 0.8.0 | 0.8.1 | 0.8.2 | 0.9.0 | 0.9.1 | 0.9.1-5 | 0.10.0 | 0.10.1 | 0.10.2 | 0.10.3 | 0.10.4 | 0.10.5 | 0.10.6 | 0.11.0 | 0.11.0:rc0 | 0.11.0:rc1 | 0.11.0:rc2 | 0.11.0-rc0 | 0.11.0-rc1 | 0.11.0-rc2 | 0.11.1 | 0.12.0 | 0.12.0:rc1 | 0.12.0:rc2 | 0.12.1 | 0.12.2 | 0.12.3 | 0.12.4 | 0.12.5 | 0.13.0 | 0.13.0:rc0 | 0.13.0:rc1 | 0.14.0 | 0.14.0:rc0 | 0.14.0:rc1 | 0.14.0:rc2 | 0.14.1 | 0.15.0:rc1 | 0.15.0:rc2 | 0.15.1 | 0.15.2 | 1.0 | 1.0:rc1 | 1.0:rc2 | 1.0:rc3 | 1.0:rc4 | 1.0.1 | 1.1 | 1.1:rc1 | 1.1:rc2 | 1.1:rc3 | 1.1:rc4 | 1.4.1 | 1.4.2 | 1.5.0 | 1.5.0:rc1 | 1.5.0:rc2 | 1.5.0:rc3 | 1.5.1 | 1.5.2 | 1.5.3 | 1.6.0 | 1.6.0:rc1 | 1.6.0:rc2 | 1.6.0:rc3 | 1.6.1 | 1.6.2 | 1.7.1 | 2.0.0:rc0 | 2.0.0:rc1 | 2.0.0:rc2 | 2.0.0:rc3
Redhat1 product
Ubuntu1 product
  • qemu< 2.0.0~rc1+dfsg-0ubuntu3.1

4 vendors · 5 products

References

13 links
Show all 13 references