QE
Product
Qemu
419
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 83Medium 221Low 26
Watch
Add Qemu to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-3214 | – | Aug 31 | The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS… Affected: through 2.3.0 |
| CVE-2015-4037 | – | Aug 26 | The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service… Affected: through 2.3.0 |
| CVE-2015-5154 | – | Aug 12 | Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute… Affected: through 2.3.0 |
| CVE-2015-3209 | – | Jun 15 | Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted… Affected: through 2.3.1 |
| CVE-2015-4106 | – | Jun 3 | QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a… Affected: through 2.3.1 |
| CVE-2015-3456 | – | May 13 | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or… Affected: through 2.3.0 |
| CVE-2014-9718 | – | Apr 21 | The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS… Affected: 1.0; 1.0; 1.0; 1.0; 1.0; 1.0.1; +34 more |
| CVE-2014-7840 | – | Dec 12 | The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2)… Affected: through 2.1.3 |
| CVE-2014-8106 | – | Dec 8 | Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit… Affected: through 2.1.2; 2.1.0; 2.1.0; 2.1.0; 2.1.0; 2.1.0; +2 more |
| CVE-2014-5388 | – | Nov 15 | Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other… Affected: through 2.1.3 |
| CVE-2014-7815 | – | Nov 14 | The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value Affected: through 2.1.3 |
| CVE-2014-3689 | – | Nov 14 | The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to… Affected: through 2.1.3 |
| CVE-2014-3640 | – | Nov 7 | The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.2; +7 more |
| CVE-2014-3461 | – | Nov 4 | hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load… Affected: 1.6.2 |
| CVE-2014-0223 | – | Nov 4 | Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2014-0222 | – | Nov 4 | Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2014-0182 | – | Nov 4 | Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-6399 | – | Nov 4 | Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4542 | – | Nov 4 | The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4541 | – | Nov 4 | The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4540 | – | Nov 4 | Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3)… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4539 | – | Nov 4 | Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1)… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4538 | – | Nov 4 | Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4537 | – | Nov 4 | The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4534 | – | Nov 4 | Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4533 | – | Nov 4 | Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4531 | – | Nov 4 | Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4530 | – | Nov 4 | Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4529 | – | Nov 4 | Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4527 | – | Nov 4 | Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4526 | – | Nov 4 | Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2013-4151 | – | Nov 4 | The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds… Affected: 1.0; 1.0; 1.0; 1.0; 1.0; 1.0.1; +21 more |
| CVE-2013-4150 | – | Nov 4 | The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary… Affected: 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.1; 1.5.2; +8 more |
| CVE-2013-4149 | – | Nov 4 | Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC… Affected: 1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.1; 1.4.1; +15 more |
| CVE-2013-4148 | – | Nov 4 | Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm… Affected: 1.0; 1.0; 1.0; 1.0; 1.0; 1.0.1; +21 more |
| CVE-2014-3615 | – | Nov 1 | The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution Affected: through 2.1.3 |
| CVE-2014-5263 | – | Aug 26 | vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service… Affected: 1.6.0 |
| CVE-2013-4544 | – | May 8 | hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or… Affected: through 1.7.1; 1.0; 1.0; 1.0; 1.0; 1.0; +22 more |
| CVE-2014-2894 | – | Apr 23 | Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE… Affected: through 1.7.1; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |
| CVE-2014-0150 | – | Apr 18 | Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table… Affected: through 2.0; through 2.0.0; 0.1.0; 0.1.1; 0.1.2; 0.1.3; +34 more |
| CVE-2011-3346 | – | Apr 1 | Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial… Affected: through 0.15.1; 0.15.0; 0.15.0 |
| CVE-2011-4111 | – | Feb 26 | Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial… Affected: through 0.15.1; 0.15.0; 0.15.0; 0.15.0; 1.0; 1.0; +2 more |
| CVE-2013-4375 | – | Jan 19 | The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant… Affected: 1.1; 1.1; 1.1; 1.1; 1.1 |
| CVE-2013-4377 | – | Oct 11 | Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a… Affected: 1.4.0; 1.4.1; 1.4.2; 1.5.0; 1.5.0; 1.5.0; +8 more |
| CVE-2013-4344 | – | Oct 4 | Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small… Affected: through 1.6.2 |
| CVE-2013-2007 | – | May 21 | The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to… Affected: 1.4.1 |
| CVE-2012-6075 | – | Feb 13 | Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote… Affected: before 1.3.0 |
| CVE-2012-3515 | – | Nov 23 | Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a… Affected: before 1.2.0 |
| CVE-2012-2652 | – | Aug 7 | The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary… Affected: 1.0 |
| CVE-2011-2527 | – | Jun 21 | The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to… Affected: through 0.14.0; 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more |