Vulnerabilities > Qemu > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-10-10 CVE-2016-7423 Unspecified vulnerability in Qemu
The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.
local
low complexity
qemu
4.4
2016-10-05 CVE-2016-7909 Infinite Loop vulnerability in multiple products
The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.
local
low complexity
qemu debian CWE-835
4.9
2016-10-05 CVE-2016-7908 Infinite Loop vulnerability in multiple products
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
local
low complexity
qemu debian CWE-835
4.4
2016-09-07 CVE-2016-6351 The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
local
low complexity
qemu canonical debian
6.7
2016-08-02 CVE-2016-5403 Resource Exhaustion vulnerability in multiple products
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
local
low complexity
canonical oracle qemu debian redhat CWE-400
4.9
2016-06-16 CVE-2016-2841 Improper Input Validation vulnerability in multiple products
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.
local
low complexity
qemu canonical CWE-20
6.0
2016-06-16 CVE-2016-2392 The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
local
low complexity
qemu canonical
6.5
2016-06-16 CVE-2016-2391 NULL Pointer Dereference vulnerability in multiple products
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
local
low complexity
qemu canonical debian CWE-476
5.0
2016-06-14 CVE-2016-5337 The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
local
low complexity
qemu canonical debian
5.5
2016-06-01 CVE-2016-4453 Infinite Loop vulnerability in multiple products
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
local
low complexity
qemu canonical debian CWE-835
4.9