QE
Product
Qemu
419
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 83Medium 221Low 26
Watch
Add Qemu to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6505 | 6.8 | Jul 5 | A flaw was found in the virtio-net device in QEMU Affected: All versions, or not specified |
| CVE-2020-35506 | 6.7 | May 28 | A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command… Affected: before 6.0.0 |
| CVE-2020-13754 | 6.7 | Jun 2 | hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation Affected: through 5.0.1 |
| CVE-2016-6351 | 6.7 | Sep 7 | The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a… Affected: through 2.6.2 |
| CVE-2016-4439 | 6.7 | May 20 | The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS… Affected: through 2.6.0 |
| CVE-2023-6683 | 6.5 | Jan 12 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages Affected: 6.1.0 before 8.2.2 |
| CVE-2023-3255 | 6.5 | Sep 13 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages Affected: through 8.0.3 |
| CVE-2023-4135 | 6.5 | Aug 4 | A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU Affected: 8.0.0 before 8.1.0; 8.1.0; 8.1.0; 8.1.0 |
| CVE-2023-3180 | 6.5 | Aug 3 | A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req Affected: before 8.1.0; 8.1.0; 8.1.0; 8.1.0 |
| CVE-2023-3019 | 6.5 | Jul 24 | A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU Affected: before 8.2.0 |
| CVE-2022-4172 | 6.5 | Nov 29 | An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record()… Affected: 7.0.0 |
| CVE-2022-4144 | 6.5 | Nov 29 | An out-of-bounds read flaw was found in the QXL display device emulation in QEMU Affected: through 7.1.0 |
| CVE-2022-3165 | 6.5 | Oct 17 | An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format Affected: 6.1.0 through 7.1.0 |
| CVE-2021-3611 | 6.5 | May 11 | A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU Affected: before 7.0.0 |
| CVE-2021-20295 | 6.5 | Apr 1 | It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise… Affected: before 4.2.0-34 |
| CVE-2021-3582 | 6.5 | Mar 25 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device Affected: before 2.17.2 |
| CVE-2021-20257 | 6.5 | Mar 16 | An infinite loop flaw was found in the e1000 NIC emulator of the QEMU Affected: before 6.2.0 |
| CVE-2021-3638 | 6.5 | Mar 3 | An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU Affected: 4.0.0 through 6.1.0 |
| CVE-2021-3930 | 6.5 | Feb 18 | An off-by-one error was found in the SCSI device emulation in QEMU Affected: before 6.2.0 |
| CVE-2021-4145 | 6.5 | Jan 25 | A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0 Affected: 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0; 6.1.0 |
| CVE-2020-27661 | 6.5 | Jun 2 | A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU Affected: through 5.1.1 |
| CVE-2019-12067 | 6.5 | Jun 2 | The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null Affected: All versions, or not specified |
| CVE-2021-3545 | 6.5 | Jun 2 | An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0 Affected: through 6.0.0 |
| CVE-2021-3544 | 6.5 | Jun 2 | Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0 Affected: through 6.0.0 |
| CVE-2021-20196 | 6.5 | May 26 | A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU Affected: 5.2.0 |
| CVE-2019-20808 | 6.5 | Dec 31 | In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation Affected: 4.1.0 |
| CVE-2020-27617 | 6.5 | Nov 6 | eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure Affected: 4.2.1 |
| CVE-2020-27616 | 6.5 | Nov 6 | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation Affected: 4.2.1 |
| CVE-2020-10717 | 6.5 | May 4 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0 Affected: 5.0 before 5.0.1 |
| CVE-2015-5745 | 6.5 | Jan 23 | Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a… Affected: before 2.4.0 |
| CVE-2015-5278 | 6.5 | Jan 23 | The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute… Affected: before 2.4.0.1 |
| CVE-2015-5239 | 6.5 | Jan 23 | Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an… Affected: before 2.1.0 |
| CVE-2018-10839 | 6.5 | Oct 16 | Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue Affected: through 3.0.0 |
| CVE-2017-2633 | 6.5 | Jul 27 | An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver Affected: before 1.7.2 |
| CVE-2017-17381 | 6.5 | Dec 7 | The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while… Affected: through 2.10.2; 2.11.0; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2017-13673 | 6.5 | Aug 29 | The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the… Affected: 2.8.0; 2.9.0 |
| CVE-2017-12809 | 6.5 | Aug 23 | QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer… Affected: through 2.9.1; 2.10.0; 2.10.0; 2.10.0 |
| CVE-2017-8379 | 6.5 | May 23 | Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption)… Affected: through 2.9.1 |
| CVE-2017-8112 | 6.5 | May 2 | hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page… Affected: through 2.9.1 |
| CVE-2017-8086 | 6.5 | May 2 | Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory… Affected: through 2.8.1; 2.9.0; 2.9.0; 2.9.0; 2.9.0 |
| CVE-2015-8345 | 6.5 | Apr 13 | The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block… Affected: through 2.4.1; 2.5.0; 2.5.0; 2.5.0 |
| CVE-2015-8613 | 6.5 | Apr 11 | Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of… Affected: through 2.5.1 |
| CVE-2015-8568 | 6.5 | Apr 11 | Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying… Affected: through 2.5.1 |
| CVE-2015-8504 | 6.5 | Apr 11 | Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat… Affected: through 2.4.1; 2.5.0; 2.5.0; 2.5.0 |
| CVE-2017-5857 | 6.5 | Mar 16 | Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host… Affected: through 2.8.1.1 |
| CVE-2017-5856 | 6.5 | Mar 16 | Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory… Affected: through 2.8.1.1 |
| CVE-2017-5667 | 6.5 | Mar 16 | The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap… Affected: through 2.8.1.1 |
| CVE-2017-5579 | 6.5 | Mar 15 | Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory… Affected: through 2.8.1.1; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +1 more |
| CVE-2017-5578 | 6.5 | Mar 15 | Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service… Affected: through 2.8.1.1 |
| CVE-2017-5552 | 6.5 | Mar 15 | Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host… Affected: through 2.8.1.1 |