CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-24352
https://notcve.org/view.php?id=CVE-2020-24352
16 Oct 2020 — An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Se detectó un problema en QEMU versiones hasta 5.1.0. • https://bugzilla.redhat.com/show_bug.cgi?id=1847584 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 3.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25742
https://notcve.org/view.php?id=CVE-2020-25742
06 Oct 2020 — pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer. La función pci_change_irq_level en el archivo hw/pci/pci.c en QEMU versiones anteriores a 5.1.1, presenta una desreferencia de puntero NULL porque la función pci_get_bus() podría no devolver un puntero válido • http://www.openwall.com/lists/oss-security/2020/09/29/1 • CWE-476: NULL Pointer Dereference •
CVSS: 3.2EPSS: 0%CPEs: 5EXPL: 0CVE-2020-25743
https://notcve.org/view.php?id=CVE-2020-25743
06 Oct 2020 — hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. El archivo hw/ide/pci.c en QEMU versiones anteriores a 5.1.1, puede desencadenar una desreferencia del puntero NULL porque carece de una comprobación de puntero antes de una llamada de ide_cancel_dma_sync • http://www.openwall.com/lists/oss-security/2020/09/29/1 • CWE-476: NULL Pointer Dereference •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 2CVE-2020-14364 – QEMU: usb: out-of-bounds r/w access issue while processing usb packets
https://notcve.org/view.php?id=CVE-2020-14364
31 Aug 2020 — An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. Se encontró un fallo de acceso de lectura/escritura fuer... • https://github.com/gejian-iscas/CVE-2020-14364 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-14415 – Ubuntu Security Notice USN-4467-1
https://notcve.org/view.php?id=CVE-2020-14415
20 Aug 2020 — oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position. La función oss_write en el archivo audio/ossaudio.c en QEMU versiones anteriores a 5.0.0, maneja inapropiadamente una posición de búfer Ziming Zhang and VictorV discovered that the QEMU SLiRP networking implementation incorrectly handled replying to certain ICMP echo requests. An attacker inside a guest could possibly use this issue to leak host memory to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS. ... • https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7a4ede0047a8613b0e3b72c9d351038f013dd357 • CWE-369: Divide By Zero •
CVSS: 3.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-12829 – Debian Security Advisory 4760-1
https://notcve.org/view.php?id=CVE-2020-12829
20 Aug 2020 — In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service. En QEMU versiones hasta 5.0.0, se encontró un desbordamiento de enteros en la implementación del controlador de pantalla SM501. Este f... • https://bugzilla.redhat.com/show_bug.cgi?id=1808510 • CWE-190: Integer Overflow or Wraparound •
CVSS: 3.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-16092 – QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c
https://notcve.org/view.php?id=CVE-2020-16092
11 Aug 2020 — In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c. En QEMU versiones hasta 5.0.0, puede ocurrir un fallo de aserción en el procesamiento de paquetes de red. Este problema afecta a los dispositivos de red e1000e y vmxnet3. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html • CWE-617: Reachable Assertion •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15863 – Debian Security Advisory 4760-1
https://notcve.org/view.php?id=CVE-2020-15863
28 Jul 2020 — hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555. El archivo hw/net/xgmac.c en el controlador Ethernet XGMAC en QEMU antes del 20/07/2020, presenta ... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html • CWE-787: Out-of-bounds Write •
CVSS: 2.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15469 – Ubuntu Security Notice USN-5010-1
https://notcve.org/view.php?id=CVE-2020-15469
02 Jul 2020 — In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. En QEMU versión 4.2.0, un objeto MemoryRegionOps puede carecer de métodos de devolución de llamada de lectura y escritura, conllevando a una desreferencia del puntero NULL Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. Wenxiang Qian discovered that QE... • http://www.openwall.com/lists/oss-security/2020/07/02/1 • CWE-476: NULL Pointer Dereference •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2020-10761 – Gentoo Linux Security Advisory 202011-09
https://notcve.org/view.php?id=CVE-2020-10761
09 Jun 2020 — An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service. Se encontró un problema de fallo de aserción en el Network Block Device (NBD) en todas las versiones de QEMU anteriores a QEMU versión 5.0.1. Este fallo ocurre cu... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html • CWE-617: Reachable Assertion •