QE
Product
Qemu
419
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 83Medium 221Low 26
Watch
Add Qemu to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-0664 | 7.8 | Mar 29 | A flaw was found in the QEMU Guest Agent service for Windows Affected: before 8.0.0 |
| CVE-2022-2962 | 7.8 | Sep 13 | A DMA reentrancy issue was found in the Tulip device emulation in QEMU Affected: 4.2.0 through 7.1.0 |
| CVE-2022-0358 | 7.8 | Aug 29 | A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation Affected: before 6.2.0-7 |
| CVE-2013-4536 | 7.8 | May 28 | An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which… Affected: before 1.5.3 |
| CVE-2013-4532 | 7.8 | Jan 2 | Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process Affected: 1.1.2\+dfsg through 2.1\+dfsg |
| CVE-2013-2016 | 7.8 | Dec 30 | A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device Affected: 1.3.0 through 1.4.2; 1.5.0 |
| CVE-2019-13164 | 7.8 | Jul 3 | qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which… Affected: 3.1; 4.0.0 |
| CVE-2019-6778 | 7.8 | Mar 17 | In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow Affected: 3.0.0 |
| CVE-2018-16867 | 7.8 | Dec 12 | A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0 Affected: through 3.0.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2018-16847 | 7.8 | Nov 2 | An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU Affected: through 3.0.0; 3.1.0; 3.1.0 |
| CVE-2014-0145 | 7.8 | Aug 10 | Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1… Affected: through 1.7.1; 2.0.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2017-7980 | 7.8 | Jul 25 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of… Affected: through 2.8 |
| CVE-2017-7493 | 7.8 | May 17 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue Affected: through 2.9.1 |
| CVE-2016-5338 | 7.8 | Jun 14 | The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute… Affected: through 2.6.2 |
| CVE-2016-5126 | 7.8 | Jun 1 | Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly… Affected: through 2.6.2 |
| CVE-2015-8567 | 7.7 | Apr 13 | Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption) Affected: through 2.5.1.1 |
| CVE-2023-3354 | 7.5 | Jul 11 | A flaw was found in the QEMU built-in VNC server Affected: before 8.1.0; 8.1.0; 8.1.0 |
| CVE-2021-3748 | 7.5 | Mar 23 | A use-after-free vulnerability was found in the virtio-net device of QEMU Affected: 0.10.0 before 6.2.0 |
| CVE-2022-26353 | 7.5 | Mar 16 | A flaw was found in the virtio-net device of QEMU Affected: 6.2.0 |
| CVE-2021-20181 | 7.5 | May 13 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0 Affected: through 5.2.0 |
| CVE-2020-7211 | 7.5 | Jan 21 | tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows Affected: 4.2.0 |
| CVE-2019-20175 | 7.5 | Dec 31 | An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0 Affected: 2.4.0 through 4.2.0 |
| CVE-2019-15890 | 7.5 | Sep 6 | libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c Affected: 4.1.0 |
| CVE-2019-12155 | 7.5 | May 24 | interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference Affected: 4.0.0 |
| CVE-2019-12247 | 7.5 | May 22 | QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables Affected: 3.0.0 |
| CVE-2019-5008 | 7.5 | Apr 19 | hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver Affected: 3.1.50 |
| CVE-2018-20191 | 7.5 | Dec 20 | hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer… Affected: through 3.1.0 |
| CVE-2018-20216 | 7.5 | Dec 20 | QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled) Affected: through 3.1.0 |
| CVE-2018-20125 | 7.5 | Dec 20 | hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings Affected: through 3.1.0 |
| CVE-2018-17962 | 7.5 | Oct 9 | Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used Affected: 2.1.0; 2.8.0; 2.12.0 |
| CVE-2018-17958 | 7.5 | Oct 9 | Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used Affected: through 3.0.1 |
| CVE-2017-7539 | 7.5 | Jul 26 | An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined Affected: before 2.10.1 |
| CVE-2018-12617 | 7.5 | Jun 21 | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to… Affected: through 2.12.50 |
| CVE-2017-15124 | 7.5 | Jan 9 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer… Affected: through 2.11.0 |
| CVE-2017-15268 | 7.5 | Oct 12 | Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c Affected: through 2.10.0 |
| CVE-2017-13711 | 7.5 | Sep 1 | Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by… Affected: through 2.10.1 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: through 2.9.1 |
| CVE-2017-9524 | 7.5 | Jul 6 | The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation… Affected: through 2.9.1 |
| CVE-2017-8309 | 7.5 | May 23 | Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio… Affected: through 2.9.1 |
| CVE-2015-8619 | 7.5 | Apr 13 | The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash) Affected: through 2.5.1.1 |
| CVE-2017-6058 | 7.5 | Mar 20 | Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to… Affected: through 2.8.1.1 |
| CVE-2016-9381 | 7.5 | Jan 23 | Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability Affected: through 2.7.1; 2.8.0 |
| CVE-2015-6855 | 7.5 | Nov 6 | hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other… Affected: through 2.4.1 |
| CVE-2021-3713 | 7.4 | Aug 25 | An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0 Affected: through 6.1.0 |
| CVE-2023-2861 | 7.1 | Dec 6 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU Affected: before 8.1.0 |
| CVE-2015-8743 | 7.1 | Dec 29 | QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue Affected: through 2.5.1 |
| CVE-2016-2538 | 7.1 | Jun 16 | Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU… Affected: through 2.5.0 |
| CVE-2023-5088 | 7.0 | Nov 3 | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code) Affected: before 8.2.0 |
| CVE-2014-0143 | 7.0 | Aug 10 | Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the… Affected: through 1.7.1 |
| CVE-2017-8284 | 7.0 | Apr 26 | The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows… Affected: through 2.8.1.1 |