CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Qemu : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-8106 119 Exec Code Overflow 2014-12-08 2014-12-09
4.6
None Local Low Not required Partial Partial Partial
Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.
2 CVE-2014-7840 20 Exec Code 2014-12-12 2014-12-15
7.5
None Remote Low Not required Partial Partial Partial
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
3 CVE-2014-7815 264 DoS 2014-11-14 2014-11-14
5.0
None Remote Low Not required None None Partial
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
4 CVE-2014-5388 119 Overflow Mem. Corr. +Info 2014-11-15 2014-11-17
4.6
None Local Low Not required Partial Partial Partial
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.
5 CVE-2014-5263 119 DoS Overflow +Priv Mem. Corr. 2014-08-26 2014-11-18
6.8
None Remote Medium Not required Partial Partial Partial
vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.
6 CVE-2014-3689 264 +Priv 2014-11-14 2014-11-14
7.2
None Local Low Not required Complete Complete Complete
The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.
7 CVE-2014-3640 DoS 2014-11-07 2014-11-18
2.1
None Local Low Not required None None Partial
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
8 CVE-2014-3615 200 +Info 2014-11-01 2014-12-06
2.1
None Local Low Not required Partial None None
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
9 CVE-2014-3461 119 Exec Code Overflow 2014-11-04 2014-11-05
6.8
None Remote Medium Not required Partial Partial Partial
hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."
10 CVE-2014-2894 189 Exec Code Mem. Corr. 2014-04-23 2014-11-13
7.2
None Local Low Not required Complete Complete Complete
Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
11 CVE-2014-0223 189 DoS Exec Code Overflow 2014-11-04 2014-11-05
4.6
None Local Low Not required Partial Partial Partial
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
12 CVE-2014-0222 189 DoS Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
13 CVE-2014-0182 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
14 CVE-2014-0150 189 Exec Code Overflow 2014-04-18 2014-05-10
4.9
None Local Network Medium Single system Partial Partial Partial
Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
15 CVE-2013-6399 94 Exec Code 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
16 CVE-2013-4544 20 DoS Exec Code 2014-05-08 2014-05-09
4.9
None Local Network Medium Single system Partial Partial Partial
hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.
17 CVE-2013-4542 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.
18 CVE-2013-4541 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.
19 CVE-2013-4540 119 Exec Code Overflow 2014-11-04 2014-12-02
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
20 CVE-2013-4539 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.
21 CVE-2013-4538 119 DoS Exec Code Overflow Mem. Corr. 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.
22 CVE-2013-4537 94 Exec Code 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
23 CVE-2013-4534 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
24 CVE-2013-4533 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
25 CVE-2013-4531 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
26 CVE-2013-4530 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.
27 CVE-2013-4529 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.
28 CVE-2013-4527 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.
29 CVE-2013-4526 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.
30 CVE-2013-4377 399 DoS 2013-10-11 2014-03-05
2.3
None Local Network Medium Single system None None Partial
Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.
31 CVE-2013-4375 399 DoS 2014-01-19 2014-03-05
2.7
None Local Network Low Single system None None Partial
The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.
32 CVE-2013-4344 119 Overflow +Priv 2013-10-04 2014-12-02
6.0
None Local High Single system Complete Complete Complete
Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.
33 CVE-2013-4151 94 Exec Code 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.
34 CVE-2013-4150 119 DoS Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.
35 CVE-2013-4149 119 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.
36 CVE-2013-4148 189 Exec Code Overflow 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
37 CVE-2013-2007 264 2013-05-21 2013-08-22
6.9
None Local Medium Not required Complete Complete Complete
The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.
38 CVE-2012-6075 119 DoS Exec Code Overflow 2013-02-12 2014-04-19
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.
39 CVE-2012-3515 20 +Priv 2012-11-23 2014-03-05
7.2
None Local Low Not required Complete Complete Complete
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
40 CVE-2012-2652 2012-08-07 2014-03-05
4.4
None Local Medium Not required Partial Partial Partial
The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.
41 CVE-2011-4111 119 DoS Exec Code Overflow 2014-02-26 2014-02-27
6.8
None Local Network High Not required Complete Complete Complete
Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.
42 CVE-2011-3346 119 DoS Overflow 2014-04-01 2014-04-01
4.0
None Local High Not required None None Complete
Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.
43 CVE-2011-2527 264 2012-06-21 2012-06-26
2.1
None Local Low Not required Partial None None
The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
44 CVE-2011-2212 119 DoS Overflow +Priv 2012-06-21 2012-06-26
7.4
None Local Network Medium Single system Complete Complete Complete
Buffer overflow in the virtio subsystem in qemu-kvm 0.14.0 and earlier allows privileged guest users to cause a denial of service (guest crash) or gain privileges via a crafted indirect descriptor related to "virtqueue in and out requests."
45 CVE-2011-1751 20 DoS Exec Code 2012-06-21 2013-02-13
7.4
None Local Network Medium Single system Complete Complete Complete
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
46 CVE-2011-1750 119 DoS Overflow +Priv 2012-06-21 2012-06-26
7.4
None Local Network Medium Single system Complete Complete Complete
Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request to the virtio_blk_handle_read function that is not properly aligned.
47 CVE-2011-0011 287 Bypass 2012-06-21 2012-06-21
4.3
None Local Network High Not required Partial Partial Partial
qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
48 CVE-2010-0297 119 DoS Exec Code Overflow 2010-02-12 2010-08-21
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted USB packet.
49 CVE-2009-3616 399 Exec Code 2009-10-23 2009-12-19
8.5
None Remote Medium Single system Complete Complete Complete
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
50 CVE-2008-5714 189 2008-12-24 2009-05-16
7.8
None Remote Low Not required Complete None None
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
Total number of vulnerabilities : 56   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.