ALPINE-CVE-2016-8909

The intelhdaxfer function in hw/audio/intel-hda.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via an entry with the same value for buffer length and pointer position...

QEMU 'v9fs_link()' function denial of service vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A denial of service vulnerability exists in the QEMU 'v9fslink' function. An attacker can exploit this vulnerability to cause a denial of...

QEUM Denial of Service Vulnerability (CNVD-2016-10300)

QEMU is a set of analog processors written by Fabrice Bellard that distributes source code under the GPL license and is widely used on the GNU/Linux platform. A security vulnerability exists in the Intel HDA controller emulation support in QEUM that can trigger a dead loop, allowing an attacker t...

QEMU 'hw/dma/rc4030.c' Denial of Service Vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A denial of service vulnerability exists in QEMU. An attacker could exploit this vulnerability to cause a denial of service QEMU instance cras...

Qemu imx_fec_do_tx() function infinite loop vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. An infinite loop vulnerability exists in the imxfecdotx function in QEMU, which can be exploited by an attacker with privileges to launch a DoS attack to crash QEMU...

QEMU 'xilinx_ethlite.c' heap buffer overflow vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. QEMU 'xilinxethlite.c' suffers from a heap buffer overflow vulnerability that allows an attacker to exploit the vulnerability to execute arbitrary code on the host, a...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability of the megasaslookupframe function in the QEMU hardware emulation software is related to the construction of the host adapter for the MegaRAID SAS 8708EM2 device. Exploiting this vulnerability allows a local attacker to cause service failures, such as out-of-memory reading and...

Qemu: ide: ahci use-after-free vulnerability in aio port commands

A use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing NCQ AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU proces...

QEMU AMD PC-Net II Ethernet Controller Packet Length Buffer Overflow Vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A buffer overflow vulnerability exists in the 'pcnetreceive' function in the hw/net/pcnet.c file in QEMU version 2.5.0, which originates from the program failing to...

QEMU 'hw/ide/core.c' Denial of Service Vulnerability

QEMU is a suite of analog processor software developed by French programmer Fabrice Bellard. A denial of service vulnerability exists in QEMU. An attacker could exploit this vulnerability to crash a QEMU instance, causing a denial of service...

UBUNTU-CVE-2015-5278

The ne2000receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service infinite loop and instance crash or possibly execute arbitrary code via vectors related to receiving packets...

CVE-2015-2151

CVE-2015-2151 affects the Xen x86 CPU emulator (xen only) where instructions with segment overrides are not properly ignored for register operands. A local guest user could read arbitrary data from other guests, trigger memory corruption causing a Denial of Service, or potentially escalate privil...

DEBIAN-CVE-2013-6399

Array index error in the virtioload function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image...

DEBIAN-CVE-2013-4529

Buffer overflow in hw/pci/pcieaer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large lognum value in a savevm image...

qemu: virtio: buffer overrun on incoming migration

Array index error in the virtioload function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image...

qemu: hpet: buffer overrun on invalid state load

Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers...

UBUNTU-CVE-2013-4540

Buffer overflow in scoopgpiohandlerupdate in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large 1 prevlevel, 2 gpiolevel, or 3 gpiodir value in a savevm image...

[slackware-security] xpdf (SSA:2013-233-02)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security xpdf SSA:2013-233-02 New xpdf packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...

Kaillera Emulation Clients Buffer Overflow

!/usr/bin/perl Exploit Title: Remote Buffer Overflows in Kaillera clients Date: 6/30/11 Author: sil3ntdre4m Software Link: Multiple: 1. Kaillera original client: An emulator to download with this client bundled with it is Project64K 0.13: http://www.zophar.net/downloadfile/1907 2. Supraclient...

Android 2.0 / 2.1 Reverse Shell Exploit

// bug = webkit code execution CVE-2010-1807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807 // listed as a safari bug but also works on android : //tested = moto droid 2.0.1 , moto droid 2.1 , emulater 2.0 - 2.1 //patched= android 2.2 //author = mj // hardcoded to return a shell to...