QE
Product
QEMU
419
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 83Medium 221Low 26
Watch
Add QEMU to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3735 | 4.4 | Aug 26 | A deadlock issue was found in the AHCI controller device of QEMU Affected: 6.1.0 |
| CVE-2020-35505 | 4.4 | May 28 | A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 Affected: before 6.0.0; 6.0.0; 6.0.0 |
| CVE-2017-18030 | 4.4 | Jan 23 | The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU… Affected: through 2.8.1.1 |
| CVE-2017-11334 | 4.4 | Aug 2 | The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and… Affected: through 2.9.1 |
| CVE-2016-7421 | 4.4 | Dec 10 | The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and… Affected: through 2.7.1 |
| CVE-2016-7170 | 4.4 | Dec 10 | The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and… Affected: through 2.7.1 |
| CVE-2016-7157 | 4.4 | Dec 10 | The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a… Affected: through 2.7.1 |
| CVE-2016-7156 | 4.4 | Dec 10 | The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU… Affected: through 2.7.1 |
| CVE-2016-7155 | 4.4 | Dec 10 | hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash)… Affected: through 2.7.1 |
| CVE-2016-6888 | 4.4 | Dec 10 | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU… Affected: through 2.6.2; 2.7.0; 2.7.0; 2.7.0; 2.7.0 |
| CVE-2016-6834 | 4.4 | Dec 10 | The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop… Affected: through 2.6.2; 2.7.0; 2.7.0; 2.7.0 |
| CVE-2016-6833 | 4.4 | Dec 10 | Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of… Affected: through 2.6.2; 2.7.0; 2.7.0; 2.7.0 |
| CVE-2016-6490 | 4.4 | Dec 10 | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU… Affected: through 2.6.2; 2.7.0 |
| CVE-2016-9104 | 4.4 | Dec 9 | Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause… Affected: through 2.7.1 |
| CVE-2016-7423 | 4.4 | Oct 10 | The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a… Affected: through 2.7.1 |
| CVE-2016-7909 | 4.4 | Oct 5 | The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process… Affected: through 2.7.1 |
| CVE-2016-7908 | 4.4 | Oct 5 | The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest… Affected: through 2.7.1 |
| CVE-2016-7907 | 4.4 | Oct 5 | The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest… Affected: through 2.8.1.1; 2.9.0; 2.9.0; 2.9.0; 2.9.0; 2.9.0; +1 more |
| CVE-2016-5105 | 4.4 | Sep 2 | The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which… Affected: through 2.6.2 |
| CVE-2016-5238 | 4.4 | Jun 14 | The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors… Affected: through 2.6.2 |
| CVE-2016-4453 | 4.4 | Jun 1 | The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA… Affected: through 2.6.0 |
| CVE-2020-29443 | 3.9 | Jan 26 | ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated Affected: 5.1.0 |
| CVE-2020-13361 | 3.9 | May 28 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access… Affected: through 5.0.0 |
| CVE-2020-11947 | 3.8 | Dec 31 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker Affected: 4.1.0 |
| CVE-2020-12829 | 3.8 | Aug 31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation Affected: through 5.0.1 |
| CVE-2020-16092 | 3.8 | Aug 11 | In QEMU through 5.0.0, an assertion failure can occur in the network packet processing Affected: through 5.0.0 |
| CVE-2019-12068 | 3.8 | Sep 24 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in… Affected: 1:4.1-1; 1:2.1+dfsg-12+deb8u6; 1:2.8+dfsg-6+deb9u8; 1:3.1+dfsg-8+deb10u2; 1:3.1+dfsg-8~deb10u1 |
| CVE-2019-20382 | 3.5 | Mar 5 | QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated… Affected: 4.1.0 |
| CVE-2015-6815 | 3.5 | Jan 31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to… Affected: before 2.4.0.1 |
| CVE-2021-20263 | 3.3 | Mar 9 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU Affected: 5.0.0 before 5.2.50 |
| CVE-2020-14415 | 3.3 | Aug 27 | oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position Affected: before 5.0.0 |
| CVE-2020-15859 | 3.3 | Jul 21 | QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address Affected: 4.2.0 |
| CVE-2020-11869 | 3.3 | Apr 27 | An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation Affected: 4.0.1 through 4.2.0 |
| CVE-2019-8934 | 3.3 | Mar 17 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a… Affected: through 3.1.0 |
| CVE-2016-9908 | 3.3 | Dec 23 | Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue Affected: through 2.8.1.1 |
| CVE-2020-14394 | 3.2 | Aug 17 | An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring Affected: 6.1.50 |
| CVE-2022-26354 | 3.2 | Mar 16 | A flaw was found in the vhost-vsock device of QEMU Affected: through 6.2.0 |
| CVE-2021-3392 | 3.2 | Mar 23 | A use-after-free flaw was found in the MegaRAID emulator of QEMU Affected: 2.10.0 through 5.2.0 |
| CVE-2021-20203 | 3.2 | Feb 25 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0 Affected: through 5.2.0 |
| CVE-2020-25723 | 3.2 | Dec 2 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU Affected: through 5.1.1 |
| CVE-2020-25743 | 3.2 | Oct 6 | hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call Affected: before 5.1.1 |
| CVE-2020-25742 | 3.2 | Oct 6 | pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer Affected: before 5.1.1 |
| CVE-2020-25741 | 3.2 | Oct 2 | fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive Affected: 5.0.0 |
| CVE-2020-25084 | 3.2 | Sep 25 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked Affected: 5.0.0 |
| CVE-2020-13362 | 3.2 | May 28 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user Affected: through 5.0.0 |
| CVE-2020-13659 | 2.5 | Jun 2 | address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer Affected: 4.2.0 |
| CVE-2020-15469 | 2.3 | Jul 2 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference Affected: through 5.0.1 |
| CVE-2015-7295 | – | Nov 9 | hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial… Affected: through 2.4.1 |
| CVE-2015-5225 | – | Nov 6 | Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption… Affected: through 2.4.0 |
| CVE-2015-5279 | – | Sep 28 | Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly… Affected: through 2.4.0 |