Qemu : Security Vulnerabilities, CVEs, Published In 2016 CVSS score >= 2
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.
Max CVSS
5.5
EPSS Score
0.05%
Published
2016-12-23
Updated
2020-12-14
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-23
Updated
2023-02-13
Memory leak in hw/9pfs/9p-proxy.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the proxy backend.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2023-02-13
Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the handle backend.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2023-02-12
Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in FileOperations.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2023-02-12
Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2023-02-12
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Max CVSS
6.5
EPSS Score
0.05%
Published
2016-12-23
Updated
2020-12-14
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-23
Updated
2023-02-13
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Max CVSS
3.3
EPSS Score
0.05%
Published
2016-12-23
Updated
2020-12-14
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-23
Updated
2023-02-12
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2020-11-10
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Max CVSS
6.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2020-11-10
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
Max CVSS
5.5
EPSS Score
0.06%
Published
2016-12-29
Updated
2020-11-10
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-12-09
Updated
2023-02-13
Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-12-09
Updated
2023-02-12
Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.
Max CVSS
4.4
EPSS Score
0.06%
Published
2016-12-09
Updated
2020-10-21
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-12-09
Updated
2023-02-12
Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-12-09
Updated
2023-02-13
Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-12-09
Updated
2020-12-14
The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2023-02-12
The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2023-02-12
The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2023-02-12
The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2020-10-21
The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2020-10-21
The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
Max CVSS
6.0
EPSS Score
0.06%
Published
2016-11-04
Updated
2020-10-21