Qemu
Page 2 of 3 — Qemu CVEs from a corpus of 265, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25625 | Medium | 5.3 | 2020-09-25 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
CVE-2020-25085 | Medium | 5.0 | 2020-09-25 | QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. |
CVE-2020-25084 | Low | 3.2 | 2020-09-25 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
CVE-2020-14364 | Medium | 5.0 | 2020-08-31 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |
CVE-2020-14415 | Low | 3.3 | 2020-08-27 | oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position. |
CVE-2020-16092 | Low | 3.8 | 2020-08-11 | In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious… |
CVE-2020-15863 | Medium | 5.3 | 2020-07-28 | hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highban… |
CVE-2020-15859 | Low | 3.3 | 2020-07-21 | QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO a… |
CVE-2020-15469 | Low | 2.3 | 2020-07-02 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. |
CVE-2020-10761 | Medium | 5.0 | 2020-06-09 | An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends… |
CVE-2020-10702 | Medium | 5.5 | 2020-06-04 | A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A ge… |
CVE-2020-13800 | Medium | 6.0 | 2020-06-04 | ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_writ… |
CVE-2020-13791 | Medium | 5.5 | 2020-06-04 | hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space. |
CVE-2020-13765 | Medium | 5.6 | 2020-06-04 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid mem… |
CVE-2020-13754 | Medium | 6.7 | 2020-06-02 | hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. |
CVE-2020-13659 | Low | 2.5 | 2020-06-02 | address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. |
CVE-2020-13362 | Low | 3.2 | 2020-05-28 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. |
CVE-2020-13361 | Low | 3.9 | 2020-05-28 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out… |
CVE-2020-13253 | Medium | 5.5 | 2020-05-27 | sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can c… |
CVE-2020-10717 | Low | 3.3 | 2020-05-04 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a… |
CVE-2020-11869 | Low | 3.3 | 2020-04-27 | An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/displ… |
CVE-2020-11102 | Medium | 5.6 | 2020-04-06 | hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. |
CVE-2019-15034 | Medium | 5.8 | 2020-03-10 | hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended con… |
CVE-2019-20382 | Low | 3.5 | 2020-03-05 | QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation whe… |
CVE-2020-1711 | High | 7.7 | 2020-02-11 | An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSC… |
CVE-2013-4535 | High | 8.8 | 2020-02-11 | The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related… |
CVE-2015-6815 | Low | 3.5 | 2020-01-31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which a… |
CVE-2015-5745 | Medium | 6.5 | 2020-01-23 | Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU proc… |
CVE-2015-5278 | Medium | 6.5 | 2020-01-23 | The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possi… |
CVE-2015-5239 | Medium | 6.5 | 2020-01-23 | Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, wh… |
CVE-2020-7211 | High | 7.5 | 2020-01-21 | tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows. |
CVE-2020-7039 | Medium | 5.6 | 2020-01-16 | tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based… |
CVE-2013-4532 | High | 7.8 | 2020-01-02 | Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEM… |
CVE-2019-20175 | High | 7.5 | 2019-12-31 | An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a spec… |
CVE-2013-2016 | High | 7.8 | 2019-12-30 | A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio devic… |
CVE-2019-12068 | Low | 3.8 | 2019-09-24 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing scrip… |
CVE-2019-15890 | High | 7.5 | 2019-09-06 | libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. |
CVE-2019-13164 | High | 7.8 | 2019-07-03 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the… |
CVE-2019-12929 | Critical | 9.8 | 2019-06-24 | The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service… |
CVE-2019-12928 | Critical | 9.8 | 2019-06-24 | The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, de… |
CVE-2019-9824 | Medium | 5.5 | 2019-06-03 | tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. |
CVE-2018-20815 | Critical | 9.8 | 2019-05-31 | In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk. |
CVE-2019-12155 | High | 7.5 | 2019-05-24 | interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. |
CVE-2019-12247 | High | 7.5 | 2019-05-22 | QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. NOTE… |
CVE-2019-5008 | High | 7.5 | 2019-04-19 | hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver. |
CVE-2019-8934 | Low | 3.3 | 2019-03-21 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model syst… |
CVE-2019-6778 | High | 7.8 | 2019-03-21 | In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. |
CVE-2019-6501 | Medium | 5.5 | 2019-03-21 | In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations. |
CVE-2018-18849 | Medium | 5.5 | 2019-03-21 | In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value. |
CVE-2019-3812 | Medium | 4.4 | 2019-02-19 | QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A l… |
CVE-2018-20191 | High | 7.5 | 2018-12-20 | hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of s… |
CVE-2018-20124 | Medium | 5.5 | 2018-12-20 | hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value. |
CVE-2018-20216 | High | 7.5 | 2018-12-20 | QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). |
CVE-2018-20126 | Medium | 5.5 | 2018-12-20 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. |
CVE-2018-20125 | High | 7.5 | 2018-12-20 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or c… |
CVE-2018-20123 | Medium | 5.5 | 2018-12-17 | pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error. |
CVE-2018-16872 | Medium | 5.3 | 2018-12-13 | A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_… |
CVE-2018-19489 | Medium | 4.7 | 2018-12-13 | v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. |
CVE-2018-19364 | Medium | 5.5 | 2018-12-13 | hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outco… |
CVE-2018-16867 | High | 7.8 | 2018-12-12 | A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to… |
CVE-2018-19665 | Medium | 5.7 | 2018-12-06 | The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption. |
CVE-2018-18954 | Medium | 5.5 | 2018-11-15 | The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory. |
CVE-2018-16847 | High | 7.8 | 2018-11-02 | An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest… |
CVE-2018-18438 | Medium | 5.5 | 2018-10-19 | Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value. |
CVE-2018-10839 | Medium | 6.5 | 2018-10-16 | Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could oc… |
CVE-2018-17963 | Critical | 9.8 | 2018-10-09 | qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have un… |
CVE-2018-17962 | High | 7.5 | 2018-10-09 | Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. |
CVE-2018-17958 | High | 7.5 | 2018-10-09 | Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. |
CVE-2018-15746 | Medium | 5.5 | 2018-08-29 | qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads… |
CVE-2017-15118 | High | 8.3 | 2018-07-27 | A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up t… |
CVE-2016-9603 | Medium | 5.5 | 2018-07-27 | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client… |
CVE-2017-2633 | Medium | 5.4 | 2018-07-27 | An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC… |
CVE-2017-2620 | Medium | 5.5 | 2018-07-27 | Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur whi… |
CVE-2017-2630 | Medium | 5.5 | 2018-07-27 | A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur w… |
CVE-2017-15119 | Medium | 5.8 | 2018-07-27 | The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large op… |
CVE-2017-7539 | Medium | 5.3 | 2018-07-26 | An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine w… |
CVE-2017-7471 | Critical | 9.0 | 2018-07-09 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. I… |
CVE-2017-2615 | Medium | 5.5 | 2018-07-03 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA dat… |
CVE-2018-12617 | High | 7.5 | 2018-06-21 | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_mall… |
CVE-2018-11806 | High | 8.2 | 2018-06-13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. |
CVE-2016-9602 | High | 7.6 | 2018-04-26 | Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access ho… |
CVE-2018-7858 | Medium | 5.5 | 2018-03-12 | Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-… |
CVE-2018-7550 | High | 8.8 | 2018-03-01 | The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh… |
CVE-2017-18043 | Medium | 5.5 | 2018-01-31 | Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash). |
CVE-2018-5683 | Medium | 6.0 | 2018-01-23 | The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveragin… |
CVE-2017-18030 | Medium | 4.4 | 2018-01-23 | The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds arr… |
CVE-2014-3471 | Medium | 5.5 | 2018-01-12 | Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via h… |
CVE-2017-15124 | High | 7.5 | 2018-01-09 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle… |
CVE-2017-17381 | Medium | 6.5 | 2017-12-07 | The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vri… |
CVE-2017-16845 | Critical | 10.0 | 2017-11-17 | hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access. |
CVE-2015-7549 | Medium | 6.0 | 2017-10-30 | The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer derefere… |
CVE-2015-7504 | High | 8.8 | 2017-10-16 | Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash)… |
CVE-2017-15289 | Medium | 6.0 | 2017-10-16 | The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access… |
CVE-2017-15268 | High | 7.5 | 2017-10-12 | Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c. |
CVE-2017-15038 | Medium | 5.6 | 2017-10-10 | Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from hos… |
CVE-2017-14167 | High | 8.8 | 2017-09-08 | Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on th… |
CVE-2017-13711 | High | 7.5 | 2017-09-01 | Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance… |
CVE-2017-13672 | Medium | 5.5 | 2017-09-01 | QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds… |
CVE-2017-13673 | Medium | 6.5 | 2017-08-29 | The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion fail… |