CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4454
https://notcve.org/view.php?id=CVE-2016-4454
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read. La función vmsvga_fifo_read_raw en hw/display/vmware_vga.c en QEMU permite a administradores locales del SO invitado obtener información sensible de la memoria del anfitrión o provocar una denegación de servicio (caída del proceso QEMU) cambiando registros FIFO y emitiendo un comando VGA, lo que desencadena una lectura fuera de rango. • http://www.openwall.com/lists/oss-security/2016/05/30/3 http://www.securityfocus.com/bid/90927 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1336429 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05271.html https://security.gentoo.org/glsa/201609-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.9EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4453
https://notcve.org/view.php?id=CVE-2016-4453
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command. La función vmsvga_fifo_run en hw/display/vmware_vga.c en QEMU permite a administradores locales del SO invitado provocar una denegación de servicio (bucle infinito y caída de proceso QEMU) a través de un comando VGA. • http://www.openwall.com/lists/oss-security/2016/05/30/2 http://www.securityfocus.com/bid/90928 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1336650 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05270.html https://security.gentoo.org/glsa/201609-01 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.7EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4439
https://notcve.org/view.php?id=CVE-2016-4439
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors. La función esp_reg_write en hw/scsi/esp.c en el soporte 53C9X Fast SCSI Controller (FSC) en QEMU no comprueba correctamente el comando de longitud del buffer, lo que permite a los administradores de SO invitados locales provocar una denegación del servicio (escritura fuera de rango y caída del proceso QEMU) o potencialmente ejecutar código arbitrario en el anfitrión QEMU a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/05/19/3 http://www.securityfocus.com/bid/90760 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1337502 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03273.html https://security.gentoo.org/glsa/201609-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4441
https://notcve.org/view.php?id=CVE-2016-4441
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command. La función get_cmd en hw/scsi/esp.c en el soporte 53C9X Fast SCSI Controller (FSC) en QEMU no comprueba correctamente la extensión DMA, lo que permite a administradores locales invitados del sistema operativo provocar una denegación del servicio (escritura fuera de rango y caída del proceso QEMU) a través de vectores no especificados, involucrando un comando SCSI. • http://www.openwall.com/lists/oss-security/2016/05/19/4 http://www.securityfocus.com/bid/90762 http://www.ubuntu.com/usn/USN-3047-1 http://www.ubuntu.com/usn/USN-3047-2 https://bugzilla.redhat.com/show_bug.cgi?id=1337505 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03274.html https://security.gentoo.org/glsa/201609-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2841
https://notcve.org/view.php?id=CVE-2016-2841
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control. La función ne2000_receive en el soporte de emulación NE2000 NIC (hw/net/ne2000.c) en QEMU en versiones anteriores a 2.5.1 permite a administradores locales del SO invitado provocar una denegación de servicio (bucle infinito y caída del proceso QEMU) a través de valores manipulados para los registros PSTART y PSTOP, involucrando control de anillo de buffer. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190 http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html http://www.openwall.com/lists/oss-security/2016/03/02/8 http://www.securityfocus.com/bid/84028 http://www.ubuntu.com/usn/USN-2974-1 https://bugzilla.redhat.com/show_bug.cgi?id=1303106 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg06126.h • CWE-20: Improper Input Validation •