CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-9381
https://notcve.org/view.php?id=CVE-2016-9381
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability. Condición de carrera en QEMU en Xen permite a administradores locales del SO invitado x86 HVM obtener privilegios cambiando ciertos datos en anillos compartidos, vulnerabilidad también conocida como "doble recuperación". • http://www.securityfocus.com/bid/94476 http://www.securitytracker.com/id/1037344 http://xenbits.xen.org/xsa/advisory-197.html https://security.gentoo.org/glsa/201612-56 https://support.citrix.com/article/CTX218775 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9915
https://notcve.org/view.php?id=CVE-2016-9915
Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the handle backend. Fuga de memoria en hw/9pfs/9p-handle.c en QEMU (también conocido como Quick Emulator) permite a usuarios privilegiados locales del SO huésped provocar una denegación de servicio (consumo de memoria del host y posiblemente caída del proceso QEMU) aprovechando una operación de limpieza perdida en la backend manejada. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=971f406b77a6eb84e0ad27dcc416b663765aee30 http://www.openwall.com/lists/oss-security/2016/12/06/11 http://www.openwall.com/lists/oss-security/2016/12/08/7 http://www.securityfocus.com/bid/94729 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html https://security.gentoo.org/glsa/201701-49 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9846
https://notcve.org/view.php?id=CVE-2016-9846
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. QEMU (vulnerabilidad también conocido como Quick Emulator) construido con el soporte de emulador Virtio GPU Device es vulnerable a un problema de fuga de memoria. Podría ocurrir mientras se actualizan los datos de cursor en update_cursor_data_virgl. • http://www.openwall.com/lists/oss-security/2016/12/05/18 http://www.openwall.com/lists/oss-security/2016/12/05/23 http://www.securityfocus.com/bid/94765 https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg00029.html https://security.gentoo.org/glsa/201701-49 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9845
https://notcve.org/view.php?id=CVE-2016-9845
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes. QEMU (vulnerabilidad también conocido como Quick Emulator) construida con el soporte de emulador Virtio GPU Device es vulnerable a un problema de fuga de información. Podría ocurrir mientras se procesa el comando 'VIRTIO_GPU_CMD_GET_CAPSET_INFO'. • http://www.openwall.com/lists/oss-security/2016/12/05/15 http://www.openwall.com/lists/oss-security/2016/12/05/22 http://www.securityfocus.com/bid/94763 https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg00019.html https://security.gentoo.org/glsa/201701-49 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9914
https://notcve.org/view.php?id=CVE-2016-9914
Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in FileOperations. Fuga de memoria en hw/9pfs/9p.c en QEMU (también conocido como Quick Emulator) permite a usuarios locales privilegiados del SO huésped provocar una denegación de servicio (consumo de memoria del host y posiblemente caída de proceso QEMU) aprovechando una operación de limpieza perdida en FileOperations. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=702dbcc274e2ca43be20ba64c758c0ca57dab91d http://www.openwall.com/lists/oss-security/2016/12/06/11 http://www.openwall.com/lists/oss-security/2016/12/08/7 http://www.securityfocus.com/bid/94729 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html https://security.gentoo.org/glsa/201701-49 • CWE-401: Missing Release of Memory after Effective Lifetime •