CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2014-8106 – qemu: cirrus: insufficient blit region checks
https://notcve.org/view.php?id=CVE-2014-8106
Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320. Desbordamiento de buffer basado en memoria dinámica en el emulador Cirrus VGA (hw/display/cirrus_vga.c) en QEMU anterior a 2.2.0 permite a usuarios locales invotados ejecutar código arbitrario a través de vectores relacionados con las regiones blit. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2007-1320. It was found that the Cirrus blit region checks were insufficient. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bf25983345ca44aec3dd92c57142be45452bd38a http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d3532a0db02296e687711b8cdc7791924efccea0 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html http://lists.gnu.org/archive/html/qemu-devel/2014-12/msg00508.html http://rhn.redhat.com/errata/RHSA-2015-0349.html http://rhn.redhat.com/errata/RHSA-2015-0624.html http://rhn.redhat.com/errata/RHSA-2015-0643.html http://rhn.redhat.com&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2014-5388
https://notcve.org/view.php?id=CVE-2014-5388
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption. Error de superación de límite (off-by-one) en la función pci_read en ACPI PCI interfaz hotplug (hw/acpi/pcihp.c) en QEMU permite a usuarios locales invitados obtener información sensible y tener otro impacto no especificado relacionado con un dispositivo PCI manipulado que provoca daños en la memoria. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16 http://seclists.org/oss-sec/2014/q3/438 http://seclists.org/oss-sec/2014/q3/440 http://www.ubuntu.com/usn/USN-2409-1 https://bugzilla.redhat.com/show_bug.cgi?id=1132956 https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.html • CWE-193: Off-by-one Error •
CVSS: 5.2EPSS: 82%CPEs: 22EXPL: 0CVE-2014-7815 – qemu: vnc: insufficient bits_per_pixel from the client sanitization
https://notcve.org/view.php?id=CVE-2014-7815
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value. La función set_pixel_format en ui/vnc.c en QEMU permite a atacantes remotos causar una denegación de servicio (caída) a través de valores pequeños de bytes_per_pixel. An uninitialized data structure use flaw was found in the way the set_pixel_format() function sanitized the value of bits_per_pixel. An attacker able to access a guest's VNC console could use this flaw to crash the guest. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html http://rhn.redhat.com/errata/RHSA-2015-0349.html http://rhn.redhat.com/errata/RHSA-2015-0624.html http://secunia.com/advisories/61484 http://secunia.com/advisories/62143 http://secunia.com/advisories/62144 http://support.citrix.com/article/CTX200892 http://www.debian.org/security/2014/dsa-3066 http://www.debian.org/secu • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2014-3689
https://notcve.org/view.php?id=CVE-2014-3689
The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling. El driver vmware-vga (hw/display/vmware_vga.c) en QEMU permite a usuarios locales invitados escribir en la localizaciones de la memoria en qemu y ganar privilegios a través de parámetros sin especificar relacionados con la manipulación del rectángulo. • http://secunia.com/advisories/60923 http://secunia.com/advisories/62143 http://secunia.com/advisories/62144 http://www.debian.org/security/2014/dsa-3066 http://www.debian.org/security/2014/dsa-3067 http://www.osvdb.org/114397 http://www.ubuntu.com/usn/USN-2409-1 https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html • CWE-269: Improper Privilege Management •
CVSS: 4.4EPSS: 0%CPEs: 22EXPL: 0CVE-2014-3640 – qemu: slirp: NULL pointer deref in sosendto()
https://notcve.org/view.php?id=CVE-2014-3640
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket. La función sosendto en slirp/udp.c en QEMU anterior a 2.1.2 permite a usuarios locales causar una denegación de servicio (referencia a puntero nulo) mediante el envió de un paquete udp con un valor de 0 en el pueto y dirección de la fuente, lo que provoca el acceso a un socket no inicializado. A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use. A local guest user could use this flaw to crash the guest. • http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html http://rhn.redhat.com/errata/RHSA-2015-0349.html http://rhn.redhat.com/errata/RHSA-2015-0624.html http://www.debian.org/security/2014/dsa-3044 http://www.debian.org/security/2014/dsa-3045 http://www.ubuntu.com/usn/USN-2409-1 https://bugzilla.redhat. • CWE-476: NULL Pointer Dereference •