Page 60 of 308 results (0.041 seconds)

CVSS: 7.5EPSS: 4%CPEs: 27EXPL: 0

CVE-2013-4151 – qemu: virtio: out-of-bounds buffer write on invalid state load

https://notcve.org/view.php?id=CVE-2013-4151

The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write. La función virtio_load en virtio/virtio.c en QEMU 1.x anterior a 1.7.2 permite a atacantes remotos ejecutar código arbitrario a través de un imagen savevm manipulado, lo que provoca una escritura fuera de rango. • http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=cc45995294b92d95319b4782750a3580cabdbc0c http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html http://rhn.redhat.com/errata/RHSA-2014-0743.html http://rhn.redhat.com/errata/RHSA-2014-0744.html https://access.redhat.com/security/cve/CVE-2013-4151 https://bugzilla.redhat.com/show_bug.cgi?id=1066342 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-787: Out-of-bounds Write •

CVSS: 4.9EPSS: 0%CPEs: 33EXPL: 0

CVE-2013-4544

https://notcve.org/view.php?id=CVE-2013-4544

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information. hw/net/vmxnet3.c en QEMU 2.0.0-rc0, 1.7.1, y anteriores permite a usuarios locales invitados causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de vectores relacionados con números de cola (1) RX o (2) TX o (3) indices interrupt. NOTA: algunos de estos detalles se obtienen de información de terceras partes. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3c99afc779c2c78718a565ad8c5e98de7c2c7484 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8c6c0478996e8f77374e69b6df68655b0b4ba689 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=9878d173f574df74bde0ff50b2f81009fbee81bb http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f12d048a523780dbda702027d4a91b62af1a08d7 http://secunia.com/advisories/58191 http://thread.gmane.org/gmane.comp.emulators.qemu/265562 http://ubuntu.com/usn/usn-2182-1 http://www.osvdb.org/106013 https&# • CWE-20: Improper Input Validation •

CVSS: 7.2EPSS: 0%CPEs: 108EXPL: 0

CVE-2014-2894 – QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART

https://notcve.org/view.php?id=CVE-2014-2894

Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. Error de superación de límite (off-by-one) en la función cmd_smart en la autoprueba SMART en hw/ide/core.c en QEMU anterior a 2.0 permite a usuarios locales tener impacto no especificado a través de un comando SMART EXECUTE OFFLINE que provoca un subdesbordamiento de buffer (buffer underflow) y corrupción de memoria. • http://rhn.redhat.com/errata/RHSA-2014-0704.html http://rhn.redhat.com/errata/RHSA-2014-0743.html http://rhn.redhat.com/errata/RHSA-2014-0744.html http://secunia.com/advisories/57945 http://secunia.com/advisories/58191 http://www.openwall.com/lists/oss-security/2014/04/15/4 http://www.openwall.com/lists/oss-security/2014/04/18/5 http://www.securityfocus.com/bid/66932 http://www.ubuntu.com/usn/USN-2182-1 https://lists.nongnu.org/archive/html/qemu-d • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •

CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0

CVE-2014-0148 – Qemu: vhdx: bounds checking for block_size and logical_sector_size

https://notcve.org/view.php?id=CVE-2014-0148

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS. El controlador de bloques de Qemu versiones anteriores a 2.0 para imágenes VHDX de Hyper-V es vulnerable a bucles infinitos y otros problemas potenciales cuando son calculadas las entradas BAT, debido a que faltan comprobaciones de límites para las variables block_size y logical_sector_size. Éstas son usadas para derivar otros campos como "sectors_per_block", etc. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d7678dec4761acdc43439da6ceda41a703ba1a6 http://rhn.redhat.com/errata/RHSA-2014-0420.html http://rhn.redhat.com/errata/RHSA-2014-0421.html http://www.openwall.com/lists/oss-security/2014/03/26/8 https://bugzilla.redhat.com/show_bug.cgi?id=1078212 https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html https://access.redhat.com/security/cve/CVE-2014-0148 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •

CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-0143 – Qemu: block: multiple integer overflow flaws

https://notcve.org/view.php?id=CVE-2014-0143

Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes. Múltiples desbordamientos de enteros en los controladores de bloque en QEMU, posiblemente en versiones anteriores a la 2.0.0, permiten que usuarios locales provoquen una denegación de servicio mediante un tamaño de catálogo manipulado en (1) la función parallels_open en block/parallels.c o (2) la función bochs_open en bochs.c, una gran tabla en (3) qcow2_snapshot_load_tmp en qcow2-snapshot.c o en la función (4) qcow2_grow_l1_table en qcow2-cluster.c, (5) una gran petición en la función bdrv_check_byte_request en block.c y otros controladores de bloqueo, (6) índices de clúster manipulados en la función get_refcount en qcow2-refcount.c, o (7) un gran número de bloqueos en la función cloop_open en cloop.c. Esto provoca desbordamientos de búfer, corrupción de memoria, grandes asignaciones de memoria y lesturas y escrituras fuera de límites. • http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=509a41bab5306181044b5fff02eadf96d9c8676a http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=afbcc40bee4ef51731102d7d4b499ee12fc182e1 http://git.qemu.org/? • CWE-190: Integer Overflow or Wraparound •