CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2858
https://notcve.org/view.php?id=CVE-2016-2858
QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption. QEMU, cuando está construido con el soporte back-end Pseudo Random Number Generator (PRNG), permite a usuarios locales del SO invitado provocar una denegación de servicio (caída del proceso) a través una petición de entropía, lo que desencadena una asignación arbitraria basada en asignación y corrupción de memoria. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956 http://www.openwall.com/lists/oss-security/2016/03/04/1 http://www.openwall.com/lists/oss-security/2016/03/07/4 http://www.securityfocus.com/bid/84134 http://www.ubuntu.com/usn/USN-2974-1 https://bugzilla.redhat.com/show_bug.cgi?id=1314676 https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html https://security.gentoo.org/glsa/201604-01 • CWE-331: Insufficient Entropy •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8701
https://notcve.org/view.php?id=CVE-2015-8701
QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue. QEMU (también conocido como Quick Emulator) construido con el soporte de emulación switch Rocker es vulnerable a un error off-by-one. Sucede mientras se procesan los descriptores de transmisión (tx) en rutina 'tx_consume', si un descriptor debía tener más fragmentos (ROCKER_TX_FRAGS_MAX=16) de los permitidos. • http://www.openwall.com/lists/oss-security/2015/12/28/6 http://www.openwall.com/lists/oss-security/2015/12/29/1 http://www.securityfocus.com/bid/79706 https://bugzilla.redhat.com/show_bug.cgi?id=1286971 https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html https://security.gentoo.org/glsa/201602-01 • CWE-193: Off-by-one Error •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7549
https://notcve.org/view.php?id=CVE-2015-7549
The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method. La compatibilidad MSI-X MMIO en hw/pci/msix.c en QEMU (también conocido como Quick Emulator) permite que usuarios privilegiados invitados locales del sistema operativo provoquen una denegación de servicio (desreferencia de puntero NULL y cierre inesperado del proceso QEMU) aprovechando el error a la hora de definir el método .write. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2015/12/14/2 http://www.securityfocus.com/bid/80761 https://bugzilla.redhat.com/show_bug.cgi?id=1291137 https://security.gentoo.org/glsa/201602-01 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1922
https://notcve.org/view.php?id=CVE-2016-1922
QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue. QEMU (también conocido como Quick Emulator) construido con el soporte de invitados TPR optimization for 32-bit Windows es vulnerable a una falla de referencia puntero null. • http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2016/01/16/1 http://www.openwall.com/lists/oss-security/2016/01/16/6 http://www.securityfocus.com/bid/81058 https://bugzilla.redhat.com/show_bug.cgi?id=1283934 https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg02812.html https://security.gentoo.org/glsa/201604-01 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2197
https://notcve.org/view.php?id=CVE-2016-2197
QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS. QEMU (también conocido como Quick Emulator) construido con un soporte de emulación IDE AHCI es vulnerable a una falla de referencia de puntero null. Ocurre mientras se desprograman las entradas Frame Information Structure (FIS) y Command List Block (CLB). • http://www.openwall.com/lists/oss-security/2016/01/29/2 http://www.openwall.com/lists/oss-security/2016/01/30/1 http://www.securityfocus.com/bid/82235 https://bugzilla.redhat.com/show_bug.cgi?id=1302057 https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05742.html https://security.gentoo.org/glsa/201604-01 • CWE-476: NULL Pointer Dereference •