QE
Product
Qemu
419
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 83Medium 221Low 26
Watch
Add Qemu to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-36648 | 10.0 | Aug 22 | The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially… Affected: through 7.0.0 |
| CVE-2017-16845 | 10.0 | Nov 17 | hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access Affected: through 2.11.2 |
| CVE-2015-8556 | 10.0 | Mar 24 | Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1 Affected: through 2.4.1 |
| CVE-2016-9603 | 9.9 | Jul 27 | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update… Affected: before 2.9.0 |
| CVE-2017-2620 | 9.9 | Jul 27 | Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue Affected: before 2.8.0 |
| CVE-2009-3616 | 9.9 | Oct 23 | Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a… Affected: through 0.10.6 |
| CVE-2019-12929 | 9.8 | Jun 24 | The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information… Affected: through 4.0.0 |
| CVE-2019-12928 | 9.8 | Jun 24 | The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or… Affected: through 4.0.0 |
| CVE-2018-20815 | 9.8 | May 31 | In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk Affected: 3.1.0 |
| CVE-2018-17963 | 9.8 | Oct 9 | qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other… Affected: through 3.0.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2017-15118 | 9.8 | Jul 27 | A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which… Affected: before 2.11 |
| CVE-2017-8380 | 9.8 | Aug 28 | Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors Affected: 2.9.0 |
| CVE-2016-7161 | 9.8 | Oct 5 | Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large… Affected: through 2.6.2; 2.7.0; 2.7.0; 2.7.0 |
| CVE-2016-4002 | 9.8 | Apr 26 | Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of… Affected: through 2.6.2 |
| CVE-2017-2615 | 9.1 | Jul 3 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue Affected: through 2.8.0 |
| CVE-2017-7471 | 9.0 | Jul 9 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue Affected: through 2.8.1.1; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2015-7512 | 9.0 | Jan 8 | Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash)… Affected: through 2.4.1; 2.5.0; 2.5.0; 2.5.0 |
| CVE-2024-24474 | 8.8 | Feb 20 | QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO… Affected: before 8.2.0 |
| CVE-2020-24165 | 8.8 | Aug 28 | An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS) Affected: 4.2.0 |
| CVE-2022-35414 | 8.8 | Jul 11 | softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash Affected: 4.1.50 through 7.0.0 |
| CVE-2022-1050 | 8.8 | Mar 29 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device Affected: before 2.20.1 |
| CVE-2013-4535 | 8.8 | Feb 11 | The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or… Affected: before 1.7.2 |
| CVE-2017-2630 | 8.8 | Jul 27 | A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support Affected: before 2.9 |
| CVE-2016-9602 | 8.8 | Apr 26 | Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS Affected: before 2.9 |
| CVE-2018-7550 | 8.8 | Mar 1 | The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value… Affected: through 2.11.1 |
| CVE-2015-7504 | 8.8 | Oct 16 | Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute… Affected: through 2.4.1; 2.5.0; 2.5.0; 2.5.0 |
| CVE-2017-14167 | 8.8 | Sep 8 | Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted… Affected: through 2.10.2 |
| CVE-2017-5931 | 8.8 | Mar 27 | Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly… Affected: through 2.8.1.1 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: through 2.5.1; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0 |
| CVE-2016-1568 | 8.8 | Apr 12 | Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly… Affected: through 2.5.1.1 |
| CVE-2022-3872 | 8.6 | Nov 7 | An off-by-one read/write issue was found in the SDHCI device of QEMU Affected: before 7.1.0; 7.1.0; 7.1.0; 7.1.0; 7.1.0; 7.1.0; +1 more |
| CVE-2014-0144 | 8.6 | Sep 29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused… Affected: before 2.0.0 |
| CVE-2017-15119 | 8.6 | Jul 27 | The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue Affected: before 2.11.0 |
| CVE-2016-4001 | 8.6 | May 23 | Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows… Affected: through 2.5.1.1; 2.6.0; 2.6.0 |
| CVE-2015-1779 | 8.6 | Jan 12 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers… Affected: through 2.2.1; 2.3.0; 2.3.0 |
| CVE-2021-3682 | 8.5 | Aug 5 | A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2 Affected: before 6.1.0; 6.1.0 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: through 2.5.1.1 |
| CVE-2024-6519 | 8.2 | Oct 21 | A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation Affected: All versions, or not specified |
| CVE-2023-2680 | 8.2 | Sep 13 | This CVE exists because of an incomplete fix for CVE-2021-3750 Affected: All versions, or not specified |
| CVE-2021-3929 | 8.2 | Aug 25 | A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU Affected: before 7.0.0 |
| CVE-2021-3750 | 8.2 | May 2 | A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU Affected: before 7.0.0 |
| CVE-2021-4207 | 8.2 | Apr 29 | A flaw was found in the QXL display device emulation in QEMU Affected: before 7.0.0 |
| CVE-2021-4206 | 8.2 | Apr 29 | A flaw was found in the QXL display device emulation in QEMU Affected: before 7.0.0 |
| CVE-2021-3546 | 8.2 | Jun 2 | An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0 Affected: through 6.0.0 |
| CVE-2020-35517 | 8.2 | Jan 28 | A flaw was found in qemu Affected: 5.0.0 through 5.2.50 |
| CVE-2018-11806 | 8.2 | Jun 13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams Affected: through 2.12.1 |
| CVE-2016-1714 | 8.1 | Apr 7 | The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS… Affected: through 2.3.0 |
| CVE-2015-8666 | 7.9 | Apr 11 | Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator Affected: through 2.4.1; 2.5.0 |
| CVE-2024-7730 | 7.8 | Nov 14 | A heap buffer overflow was found in the virtio-snd device in QEMU Affected: before 9.1.0 |
| CVE-2023-1386 | 7.8 | Jul 24 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU Affected: All versions, or not specified |