CVSS: 9.3EPSS: 2%CPEs: 24EXPL: 0CVE-2012-6075 – qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled
https://notcve.org/view.php?id=CVE-2012-6075
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet. Desbordamiento de buffer en la función e1000_receive del controlador de dispositivo e1000 (hw/e1000.c) en QEMU v1.3.0-rc2 y otras versiones, cuando las banderas de PAS y LPE están deshabilitadas, permiten ataques remotos que provocan una denegación de servicios (errores en el sistema operativo invitado) y posiblemente ejecutar código arbitrario. • http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097541.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097575.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097705.html http://lists.nongnu.org/archive/html/qemu-devel/2012-12/msg00533.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 0CVE-2012-3515 – qemu: VT100 emulation vulnerability
https://notcve.org/view.php?id=CVE-2012-3515
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Qemu, tal como se utiliza en Xen v4.0, v4.1 y posiblemente otros productos, al emular ciertos dispositivos con una consola virtual, permite a los usuarios locales del SO invitado obtener privilegios a través de una secuencia VT100 de escape manipulada que desencadena la sobrescritura del espacio de direcciones de un "device model's address space." • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.ht • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2012-2652
https://notcve.org/view.php?id=CVE-2012-2652
The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file. La función bdrv_open en Qemu v1.0 no gestiona de forma adecuada el fallo en la función mkstemp en un nodo snapshot, lo que permite a usuario locales sobrescribir o leer ficheros a través de un ataque de enlace simbólico sobre un fichero temporal no especificado. • http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=eba25057b9a5e19d10ace2bc7716667a31297169 http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html http://secunia.com/advisories/50132 http://secunia.com/advisories/50689 http://www.debian.org/security/2012/dsa-2545 http://www.securityfocus.com/bid/53725 http://www.ubuntu.com/usn/USN-1522-1 •
CVSS: 6.8EPSS: 5%CPEs: 10EXPL: 0CVE-2011-4111 – qemu: ccid: buffer overflow in handling of VSC_ATR message
https://notcve.org/view.php?id=CVE-2011-4111
Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message. Desbordamiento de buffer en la función ccid_card_vscard_handle_message en hw/ccid-card-passthru.c en QEMU anterior a 0.15.2 y 1.x anterior a 1.0-rc4 permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un mensaje VSC_ATR manipulado. • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0 http://rhn.redhat.com/errata/RHSA-2011-1777.html http://rhn.redhat.com/errata/RHSA-2011-1801.html https://bugzilla.redhat.com/show_bug.cgi?id=751310 https://access.redhat.com/security/cve/CVE-2011-4111 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 2CVE-2011-3346 – qemu: local DoS with SCSI CD-ROM
https://notcve.org/view.php?id=CVE-2011-3346
Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs. Desbordamiento de buffer en hw/scsi-disk.c en el subsistema SCSI en QEMU anterior a 0.15.2, utilizado por Xen, podría permitir a usuarios locales invitados con permiso para acceder al CD-ROM causar una denegación de servicio (caída de invitado) a través de un comando SAI READ CAPACITY SCSI manipulado. NOTA: esto es solo una vulnerabilidad cuando root ha modificado manualmente ciertos permisos o ACLs. • http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://www.openwall.com/lists/oss-security/2011/10/20/2 http://www.redhat.com/support/errata/RHSA-2011-1401.html https://bugzilla.redhat.com/show_bug.cgi?id=736038 https://github.com/bonzini/qemu/commit/103b40f51e4012b3b0ad20f615562a1806d7f49a https://github.com/bonzini/qemu/commit/7285477ab11831b1cf56e45878a89170dd06d9b9 https://access.redhat.com/security/cve/CVE-2011-3346 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •