CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10029
https://notcve.org/view.php?id=CVE-2016-10029
The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts. La función virtio_gpu_set_scanout en QEMU (también conocido como Quick Emulator) construido con el apoyo del emulador Virtio GPU Device permite a los usuarios locales de SO invitados provocar una denegación de servicio (lectura fuera de límites y caída del proceso) a través de un id scanout en un comando VIRTIO_GPU_CMD_SET_SCANOUT mayor que num_scanouts. • http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7 http://www.openwall.com/lists/oss-security/2016/12/20/2 http://www.openwall.com/lists/oss-security/2016/12/22/15 http://www.securityfocus.com/bid/94978 http://www.securitytracker.com/id/1037526 • CWE-125: Out-of-bounds Read •
CVSS: 9.9EPSS: 0%CPEs: 32EXPL: 0CVE-2017-2620 – Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo
https://notcve.org/view.php?id=CVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. Quick emulator (QEMU) en versiones anteriores a la 2.8 construido con el soporte del emulador Cirrus CLGD 54xx VGA Emulator es vulnerable a un problema de acceso fuera de límites. El problema puede ocurrir al copiar datos VGA en cirrus_bitblt_cputovideo. • http://rhn.redhat.com/errata/RHSA-2017-0328.html http://rhn.redhat.com/errata/RHSA-2017-0329.html http://rhn.redhat.com/errata/RHSA-2017-0330.html http://rhn.redhat.com/errata/RHSA-2017-0331.html http://rhn.redhat.com/errata/RHSA-2017-0332.html http://rhn.redhat.com/errata/RHSA-2017-0333.html http://rhn.redhat.com/errata/RHSA-2017-0334.html http://rhn.redhat.com/errata/RHSA-2017-0350.html http://rhn.redhat.com/errata/RHSA-2017-0351.html http://rhn • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2016-10155 – Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
https://notcve.org/view.php?id=CVE-2016-10155
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Pérdida de memoria en hw/watchdog/wdt_i6300esb.c en QEMU (también conocido como Quick Emulator) permite a usuarios locales privilegiados locales del SO invitado provocar una denegación de servicio (consumo de memoria del host y caída del proceso QEMU) a través de un gran número de operaciones de desenchufado del dispositivo. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e http://www.openwall.com/lists/oss-security/2017/01/20/14 http://www.openwall.com/lists/oss-security/2017/01/21/4 http://www.securityfocus.com/bid/95770 https://access.redhat.com/errata/RHSA-2017:2392 https://access.redhat.com/errata/RHSA-2017:2408 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://security.gentoo.org/glsa/201702-28 https://access.redhat.com/ • CWE-401: Missing Release of Memory after Effective Lifetime CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-5898 – Qemu: usb: integer overflow in emulated_apdu_from_guest
https://notcve.org/view.php?id=CVE-2017-5898
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit. Desbordamiento de entero en la función emulated_apdu_from_guest en usb/dev-smartcard-reader.c en Quick Emulator (Qemu), cuando se construye con el soporte de emulador de dispositivo de CCID Card, permite a usuarios locales provocar una denegación de servicio (caída de aplicación) a través de una unidad Unidad de datos de protocolo (APDU) grande. An integer overflow flaw was found in Quick Emulator (QEMU) in the CCID Card device support. The flaw could occur while passing messages via command/response packets to and from the host. A privileged user inside a guest could use this flaw to crash the QEMU process. • http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html http://www.openwall.com/lists/oss-security/2017/02/07/3 http://www.securityfocus.com/bid/96112 https://access.redhat.com/errata/RHSA-2017:1856 https://access.redhat.com/errata/RHSA-2017:2392 https://bugzilla.redhat.com/show_bug.cgi?id=1419699 htt • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5525
https://notcve.org/view.php?id=CVE-2017-5525
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations. Pérdida de memoria en hw/audio/ac97.c en QEMU (también conocido como Quick Emulator) permite a usuarios locales privilegiados del SO invitado provocar una denegación de servicio (consumo de memoria del host y caída del proceso QEMU) a través de un gran número de operaciones de desenchufado del dispositivo. • http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401 http://www.openwall.com/lists/oss-security/2017/01/17/19 http://www.openwall.com/lists/oss-security/2017/01/18/7 http://www.securityfocus.com/bid/95671 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://security.gentoo.org/glsa/201702-28 • CWE-401: Missing Release of Memory after Effective Lifetime •