CVSS: 7.7EPSS: 0%CPEs: 10EXPL: 1CVE-2015-3456 – QEMU - Floppy Disk Controller (FDC) (PoC)
https://notcve.org/view.php?id=CVE-2015-3456
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. Floppy Disk Controller (FDC) en QEMU, utilizado en Xen 4.5.x y anteriores y KVM, permite a usuarios locales invitados causar una denegación de servicio (escritura fuera de rango y caída del invitado) o posiblemente ejecutar código arbitrario a través de (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, u otros comandos sin especificar, también conocido como VENOM. An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. • https://www.exploit-db.com/exploits/37053 http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html http:/&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 2.7EPSS: 0%CPEs: 10EXPL: 0CVE-2013-4375
https://notcve.org/view.php?id=CVE-2013-4375
The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors. El backend PV qdisk en qemu-xen de Xen 4.2.x y 4.3.x anteriores a 4.3.1, y qemu 1.1 y otras versiones, permite a invitados locales HVM causar una denegación de servicio (consumo de referencia de concesión de dominio) a través de vectores no especificados. • http://security.gentoo.org/glsa/glsa-201407-03.xml http://www.openwall.com/lists/oss-security/2013/10/10/14 http://www.ubuntu.com/usn/USN-2092-1 http://xenproject.org/downloads/xen-archives/supported-xen-43-series/xen-431.html • CWE-399: Resource Management Errors •
CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2012-3515 – qemu: VT100 emulation vulnerability
https://notcve.org/view.php?id=CVE-2012-3515
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Qemu, tal como se utiliza en Xen v4.0, v4.1 y posiblemente otros productos, al emular ciertos dispositivos con una consola virtual, permite a los usuarios locales del SO invitado obtener privilegios a través de una secuencia VT100 de escape manipulada que desencadena la sobrescritura del espacio de direcciones de un "device model's address space." • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.ht • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 2CVE-2011-3346 – qemu: local DoS with SCSI CD-ROM
https://notcve.org/view.php?id=CVE-2011-3346
Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs. Desbordamiento de buffer en hw/scsi-disk.c en el subsistema SCSI en QEMU anterior a 0.15.2, utilizado por Xen, podría permitir a usuarios locales invitados con permiso para acceder al CD-ROM causar una denegación de servicio (caída de invitado) a través de un comando SAI READ CAPACITY SCSI manipulado. NOTA: esto es solo una vulnerabilidad cuando root ha modificado manualmente ciertos permisos o ACLs. • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://www.openwall.com/lists/oss-security/2011/10/20/2 http://www.redhat.com/support/errata/RHSA-2011-1401.html https://bugzilla.redhat.com/show_bug.cgi?id=736038 https://github.com/bonzini/qemu/commit/103b40f51e4012b3b0ad20f615562a1806d7f49a https://github.com/bonzini/qemu/commit/7285477ab11831b1cf56e45878a89170dd06d9b9 https://access.redhat.com/security/cve/CVE-2011-3346 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2007-5730 – QEMU Buffer overflow via crafted "net socket listen" option
https://notcve.org/view.php?id=CVE-2007-5730
Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability. Un desbordamiento de búfer en la región heap de la memoria en QEMU versión 0.8.2, como es usado en Xen y posiblemente otros productos, permite a usuarios locales ejecutar código arbitrario por medio de datos diseñados en la opción "net socket listen", también se conoce como desbordamiento de pila "net socket" de QEMU. NOTA: algunas fuentes han usado el CVE-2007-1321 para referirse a este problema como parte de "NE2000 network driver and the socket code”, pero este es el identificador correcto para la vulnerabilidad de escucha de socket de red individual. • http://osvdb.org/42985 http://secunia.com/advisories/25073 http://secunia.com/advisories/25095 http://secunia.com/advisories/27486 http://secunia.com/advisories/29129 http://secunia.com/advisories/29963 http://taviso.decsystem.org/virtsec.pdf http://www.attrition.org/pipermail/vim/2007-October/001842.html http://www.debian.org/security/2007/dsa-1284 http://www.mandriva.com/security/advisories?name=MDKSA-2007:203 http://www.mandriva.com/security/advisories?name=MDVSA-2008:162 • CWE-787: Out-of-bounds Write •