CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1714 – Qemu: nvram: OOB r/w access in processing firmware configurations
https://notcve.org/view.php?id=CVE-2016-1714
The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration. Las funciones (1) fw_cfg_write y (2) fw_cfg_read en hw/nvram/fw_cfg.c en QEMU en versiones anteriores a 2.4, cuando construye con el soporte de emulación de dispositivo de Firmware Configuration, permiten a usuarios del SO invitado con el privilegio CAP_SYS_RAWIO provocar una denegación de servicio (acceso a lectura o escritura fuera de rango y caída del proceso) o potencialmente ejecutar código arbitrario a través de un valor de entrada actual no válido en una configuración de firmware. An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. • http://rhn.redhat.com/errata/RHSA-2016-0081.html http://rhn.redhat.com/errata/RHSA-2016-0082.html http://rhn.redhat.com/errata/RHSA-2016-0083.html http://rhn.redhat.com/errata/RHSA-2016-0084.html http://rhn.redhat.com/errata/RHSA-2016-0085.html http://rhn.redhat.com/errata/RHSA-2016-0086.html http://rhn.redhat.com/errata/RHSA-2016-0087.html http://rhn.redhat.com/errata/RHSA-2016-0088.html http://www.debian.org/security/2016/dsa-3469 http://www.debia • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 3CVE-2015-8556 – QEMU (Gentoo) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-8556
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1. Vulnerabilidad de escalada de privilegios locales en el paquete Gentoo QEMU en versiones anteriores a 2.5.0-r1. • https://www.exploit-db.com/exploits/39010 http://packetstormsecurity.com/files/134948/Gentoo-QEMU-Local-Privilege-Escalation.html https://security.gentoo.org/glsa/201602-01 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2015-8345
https://notcve.org/view.php?id=CVE-2015-8345
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list. El emulador de eepro100 en qemu-kvm de QEMU permite a los usuarios huéspedes locales provocar una denegación de servicio (fallo de la aplicación y bucle infinito) a través de vectores que implican la lista de bloqueo de comandos. • http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2015/11/25/11 http://www.securityfocus.com/bid/77985 https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html https://security.gentoo.org/glsa/201602-01 • CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2015-7504 – Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive
https://notcve.org/view.php?id=CVE-2015-7504
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode. Desbordamiento de búfer basado en memoria dinámica (heap) en la función pcnet_receive en hw/net/pcnet.c en QEMU permite que administradores del sistema operativo invitados provoquen una denegación de servicio (cierre inesperado de la instancia) o que puedan ejecutar código arbitrario mediante una serie de paquetes en modo de bucle invertido. A heap-based buffer overflow flaw was discovered in the way QEMU's AMD PC-Net II Ethernet Controller emulation received certain packets in loopback mode. A privileged user (with the CAP_SYS_RAWIO capability) inside a guest could use this flaw to crash the host QEMU process (resulting in denial of service) or, potentially, execute arbitrary code with privileges of the host QEMU process. • http://rhn.redhat.com/errata/RHSA-2015-2694.html http://rhn.redhat.com/errata/RHSA-2015-2695.html http://rhn.redhat.com/errata/RHSA-2015-2696.html http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2015/11/30/2 http://www.securityfocus.com/bid/78227 http://www.securitytracker.com/id/1034268 http://xenbits.xen.org/xsa/advisory • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 4%CPEs: 14EXPL: 0CVE-2015-7512 – Qemu: net: pcnet: buffer overflow in non-loopback mode
https://notcve.org/view.php?id=CVE-2015-7512
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet. Desbordamiento de buffer en la función pcnet_receive en hw/net/pcnet.c en QEMU, cuando un NIC invitado tiene un MTU más grande, permite a atacantes provocar una denegación de servicio (caída de SO invitado) o ejecutar código arbitrario a través de un paquete grande. A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Note that to exploit this flaw, the guest network interface must have a large MTU limit. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f http://rhn.redhat.com/errata/RHSA-2015-2694.html http://rhn.redhat.com/errata/RHSA-2015-2695.html http://rhn.redhat.com/errata/RHSA-2015-2696.html http://www.debian.org/security/2016/dsa-3469 http://www.debian.org/security/2016/dsa-3470 http://www.debian.org/security/2016/dsa-3471 http://www.openwall.com/lists/oss-security/2015/11/30/3 http://www.oracle.com/technetwork/topics/securi • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •