CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1981 – Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines
https://notcve.org/view.php?id=CVE-2016-1981
QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS. QEMU (también conocido como Quick Emulator) construido con el soporte de emulación e1000 NIC es vulnerable a un problema de bucle infinito. Podría ocurrir mientras se procesan datos a través de descriptores de transmisión o recepción, siempre que la cabeza inicial del descriptor de recepción/transmisión (TDH/RDH) se establezca fuera del búfer de descriptor asignado. • http://rhn.redhat.com/errata/RHSA-2016-2585.html http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2016/01/19/10 http://www.openwall.com/lists/oss-security/2016/01/22/1 http://www.securityfocus.com/bid/81549 https://bugzilla.redhat.com/show_bug.cgi?id=1298570 https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2016-2198
https://notcve.org/view.php?id=CVE-2016-2198
QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS. QEMU (también conocido como Quick Emulator) construido con el soporte de emulación USB EHCI es vulnerable a una falla de referencia de puntero null. Podría ocurrir cuando una aplicación trata de escribir en los registros de capacidades EHCI. • http://www.openwall.com/lists/oss-security/2016/01/29/6 http://www.openwall.com/lists/oss-security/2016/01/30/2 https://bugzilla.redhat.com/show_bug.cgi?id=1301643 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html https://security.gentoo.org/glsa/201604-01 • CWE-476: NULL Pointer Dereference •
CVSS: 7.9EPSS: 0%CPEs: 3EXPL: 0CVE-2015-8666
https://notcve.org/view.php?id=CVE-2015-8666
Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator. Desbordamiento de búfer basado en memoria dinámica en QEMU, cuando se construye con el emulador de sistema de PC basado en el chipset Q35. • http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb http://www.openwall.com/lists/oss-security/2015/12/24/1 http://www.securityfocus.com/bid/79670 https://bugzilla.redhat.com/show_bug.cgi?id=1283722 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://security.gentoo.org/glsa/201602-01 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2197
https://notcve.org/view.php?id=CVE-2016-2197
QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS. QEMU (también conocido como Quick Emulator) construido con un soporte de emulación IDE AHCI es vulnerable a una falla de referencia de puntero null. Ocurre mientras se desprograman las entradas Frame Information Structure (FIS) y Command List Block (CLB). • http://www.openwall.com/lists/oss-security/2016/01/29/2 http://www.openwall.com/lists/oss-security/2016/01/30/1 http://www.securityfocus.com/bid/82235 https://bugzilla.redhat.com/show_bug.cgi?id=1302057 https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05742.html https://security.gentoo.org/glsa/201604-01 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1568 – Qemu: ide: ahci use-after-free vulnerability in aio port commands
https://notcve.org/view.php?id=CVE-2016-1568
Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command. Vulnerabilidad de uso después de liberación de memoria en hw/ide/ahci.c en QEMU, cuando se construye con soporte de emulación IDE AHCI, permite a usuarios del SO invitado causar una denegación de servicio (caída de instancia) o posiblemente ejecutar código arbitrario a través de un comando AHCI Native Command Queuing (NCQ) AIO no válido. A use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing (NCQ) AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab http://rhn.redhat.com/errata/RHSA-2016-0084.html http://rhn.redhat.com/errata/RHSA-2016-0086.html http://rhn.redhat.com/errata/RHSA-2016-0087.html http://rhn.redhat.com/errata/RHSA-2016-0088.html http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2016/0 • CWE-416: Use After Free •