CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-5106
https://notcve.org/view.php?id=CVE-2016-5106
The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command. La función megasas_dcmd_set_properties en hw/scsi/megasas.c en QEMU, cuando está construido con soporte de emulación MegaRAID SAS 8708EM2 Host Bus Adapter, permite a administradores locales invitados provocar una denegación de servicio (acceso a escritura fuera de rango) a través de vectores que implican un comando MegaRAID Firmware Interface (MFI). • http://www.openwall.com/lists/oss-security/2016/05/25/6 http://www.openwall.com/lists/oss-security/2016/05/26/8 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1339578 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04340.html https://security.gentoo.org/glsa/201609-01 • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2016-6351
https://notcve.org/view.php?id=CVE-2016-6351
The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer. La función esp_do_dma en hw/scsi/esp.c en QEMU (también conocido como Quick Emulator), cuando se construye con soporte de emulación del controlador ESP/NCR53C9x, permite a administradores locales del SO invitado provocar una denegación de servicio (escritura fuera de rango y caída del proceso QEMU) o ejecutar código arbitrario en el anfitrión de QEMU a través de vectores que involucran lectura de DMA en búfer de comandos ESP. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7cad6fd11 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75db069e3 http://www.openwall.com/lists/oss-security/2016/07/25/14 http://www.openwall.com/lists/oss-security/2016/07/26/7 http://www.securityfocus.com/bid/92119 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4952
https://notcve.org/view.php?id=CVE-2016-4952
QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command. QEMU (también conocido como Quick Emulator), cuando está construido con soporte de emulación bus VMWARE PVSCSI paravirtual SCSI, permite a administradores locales del SO invitado provocar una denegación de servicio (acceso al array fuera de rango) a través de vectores relacionados con el comando (1) PVSCSI_CMD_SETUP_RINGS o (2) PVSCSI_CMD_SETUP_MSG_RING SCSI. • http://www.openwall.com/lists/oss-security/2016/05/23/1 http://www.openwall.com/lists/oss-security/2016/05/23/4 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1334384 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03774.html • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 38EXPL: 0CVE-2016-5403 – Qemu: virtio: unbounded memory allocation on host via guest leading to DoS
https://notcve.org/view.php?id=CVE-2016-5403
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. La función virtqueue_pop en hw/virtio/virtio.c en QEMU permite a administradores locales del SO invitado provocar una denegación de servicio (consumo de memoria y caida del proceso QUEMU) mediante la presentación de solicitudes sin esperar la finalización. Quick Emulator (QEMU) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement results in unbounded memory allocation on the host controlled by the guest. • http://rhn.redhat.com/errata/RHSA-2016-1585.html http://rhn.redhat.com/errata/RHSA-2016-1586.html http://rhn.redhat.com/errata/RHSA-2016-1606.html http://rhn.redhat.com/errata/RHSA-2016-1607.html http://rhn.redhat.com/errata/RHSA-2016-1652.html http://rhn.redhat.com/errata/RHSA-2016-1653.html http://rhn.redhat.com/errata/RHSA-2016-1654.html http://rhn.redhat.com/errata/RHSA-2016-1655.html http://rhn.redhat.com/errata/RHSA-2016-1756.html http://rhn • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-5337
https://notcve.org/view.php?id=CVE-2016-5337
The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information. La función megasas_ctrl_get_info en hw/scsi/megasas.c en QEMU permite a administradores locales del SO invitado obtener información sensible de la memoria del anfitrión a través de vectores relacionados con la lectura de información de control del dispositivo. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=844864fbae66935951529408831c2f22367a57b6 http://www.openwall.com/lists/oss-security/2016/06/08/13 http://www.openwall.com/lists/oss-security/2016/06/08/3 http://www.securityfocus.com/bid/91097 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01969.html https://secur •