CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2012-3515 – qemu: VT100 emulation vulnerability
https://notcve.org/view.php?id=CVE-2012-3515
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Qemu, tal como se utiliza en Xen v4.0, v4.1 y posiblemente otros productos, al emular ciertos dispositivos con una consola virtual, permite a los usuarios locales del SO invitado obtener privilegios a través de una secuencia VT100 de escape manipulada que desencadena la sobrescritura del espacio de direcciones de un "device model's address space." • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.ht • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2012-2652
https://notcve.org/view.php?id=CVE-2012-2652
The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file. La función bdrv_open en Qemu v1.0 no gestiona de forma adecuada el fallo en la función mkstemp en un nodo snapshot, lo que permite a usuario locales sobrescribir o leer ficheros a través de un ataque de enlace simbólico sobre un fichero temporal no especificado. • http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=eba25057b9a5e19d10ace2bc7716667a31297169 http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html http://secunia.com/advisories/50132 http://secunia.com/advisories/50689 http://www.debian.org/security/2012/dsa-2545 http://www.securityfocus.com/bid/53725 http://www.ubuntu.com/usn/USN-1522-1 •
CVSS: 6.8EPSS: 5%CPEs: 10EXPL: 0CVE-2011-4111 – qemu: ccid: buffer overflow in handling of VSC_ATR message
https://notcve.org/view.php?id=CVE-2011-4111
Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message. Desbordamiento de buffer en la función ccid_card_vscard_handle_message en hw/ccid-card-passthru.c en QEMU anterior a 0.15.2 y 1.x anterior a 1.0-rc4 permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un mensaje VSC_ATR manipulado. • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0 http://rhn.redhat.com/errata/RHSA-2011-1777.html http://rhn.redhat.com/errata/RHSA-2011-1801.html https://bugzilla.redhat.com/show_bug.cgi?id=751310 https://access.redhat.com/security/cve/CVE-2011-4111 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 2CVE-2011-3346 – qemu: local DoS with SCSI CD-ROM
https://notcve.org/view.php?id=CVE-2011-3346
Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs. Desbordamiento de buffer en hw/scsi-disk.c en el subsistema SCSI en QEMU anterior a 0.15.2, utilizado por Xen, podría permitir a usuarios locales invitados con permiso para acceder al CD-ROM causar una denegación de servicio (caída de invitado) a través de un comando SAI READ CAPACITY SCSI manipulado. NOTA: esto es solo una vulnerabilidad cuando root ha modificado manualmente ciertos permisos o ACLs. • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://www.openwall.com/lists/oss-security/2011/10/20/2 http://www.redhat.com/support/errata/RHSA-2011-1401.html https://bugzilla.redhat.com/show_bug.cgi?id=736038 https://github.com/bonzini/qemu/commit/103b40f51e4012b3b0ad20f615562a1806d7f49a https://github.com/bonzini/qemu/commit/7285477ab11831b1cf56e45878a89170dd06d9b9 https://access.redhat.com/security/cve/CVE-2011-3346 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.7EPSS: 0%CPEs: 57EXPL: 0CVE-2011-2527 – qemu: when started as root, extra groups are not dropped correctly
https://notcve.org/view.php?id=CVE-2011-2527
The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host. La función change_process_uid en os-posix.c en Qemu v0.14.0 y anteriores no "suelta" correctamente los privilegios de grupo cuando se usa la opción -runas, lo que permite acceder a archivos restringidos en el host a usuarios locales invitados. • http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081972.html http://lists.opensuse.org/opensuse-updates/2012-02/msg00009.html http://rhn.redhat.com/errata/RHSA-2011-1531.html http://secunia.com/advisories/45187 http://secunia.com/advisories/45188 http://secunia.com/advisories/45419 http://secunia.com/advisories/47157 http://secunia.com/advisories/47992 http://ubuntu.com/usn/usn-1177-1 http://www.openwall.com/lists/oss-security/2011/07/12/15 http:/&# • CWE-264: Permissions, Privileges, and Access Controls •