Vulnerabilities > Qemu > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-12-10 | CVE-2016-6888 | Integer Overflow or Wraparound vulnerability in multiple products Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference. | 4.4 |
| 2016-12-10 | CVE-2016-6836 | Improper Initialization vulnerability in multiple products The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object. | 6.0 |
| 2016-12-10 | CVE-2016-6835 | The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length. | 6.0 |
| 2016-12-10 | CVE-2016-6834 | Classic Buffer Overflow vulnerability in multiple products The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length. | 4.4 |
| 2016-12-10 | CVE-2016-6833 | Use After Free vulnerability in multiple products Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active. | 4.4 |
| 2016-12-10 | CVE-2016-6490 | Classic Buffer Overflow vulnerability in Qemu The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer. | 4.4 |
| 2016-12-10 | CVE-2016-4964 | Unspecified vulnerability in Qemu The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state. | 6.0 |
| 2016-12-09 | CVE-2016-9106 | Missing Release of Resource after Effective Lifetime vulnerability in multiple products Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector. | 6.0 |
| 2016-12-09 | CVE-2016-9105 | Missing Release of Resource after Effective Lifetime vulnerability in multiple products Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object. | 6.0 |
| 2016-12-09 | CVE-2016-9104 | Integer Overflow or Wraparound vulnerability in multiple products Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access. | 4.4 |