Vulnerabilities > Qemu

DATE CVE VULNERABILITY TITLE RISK
2017-11-17 CVE-2017-16845 Improper Input Validation vulnerability in multiple products
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
network
low complexity
qemu debian canonical CWE-20
critical
10.0
2017-10-30 CVE-2015-7549 NULL Pointer Dereference vulnerability in Qemu
The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.
local
low complexity
qemu CWE-476
6.0
2017-10-16 CVE-2015-7504 Out-of-bounds Write vulnerability in multiple products
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
local
low complexity
qemu xen debian CWE-787
8.8
2017-10-16 CVE-2017-15289 Out-of-bounds Write vulnerability in Qemu
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
local
low complexity
qemu CWE-787
6.0
2017-10-12 CVE-2017-15268 Missing Release of Resource after Effective Lifetime vulnerability in Qemu
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
network
low complexity
qemu CWE-772
7.5
2017-10-10 CVE-2017-15038 Race Condition vulnerability in Qemu
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
local
high complexity
qemu CWE-362
5.6
2017-09-08 CVE-2017-14167 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
local
low complexity
qemu debian CWE-190
8.8
2017-09-01 CVE-2017-13711 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
network
low complexity
qemu debian CWE-416
7.5
2017-09-01 CVE-2017-13672 Out-of-bounds Read vulnerability in multiple products
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
local
low complexity
qemu debian CWE-125
5.5
2017-08-29 CVE-2017-13673 Reachable Assertion vulnerability in Qemu 2.8.0/2.9.0
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
network
low complexity
qemu CWE-617
6.5