CVE-2017-10664

qemu-nbd in QEMU aka Quick Emulator does not ignore SIGPIPE, which allows remote attackers to cause a denial of service daemon crash by disconnecting during a server-to-client reply attempt...

Qemu: ide: ahci host memory leakage during hotunplug

Memory leak in QEMU aka Quick Emulator, when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service memory consumption by repeatedly hot-unplugging the AHCI device...

Qemu: input: host memory lekage via keyboard events

Memory leak in the keyboard input event handlers support in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service host memory consumption by rapidly generating large keyboard events...

Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb

Memory leak in hw/watchdog/wdti6300esb.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service host memory consumption and QEMU process crash via a large number of device unplug operations...

Qemu: char: divide by zero error in serial_update_parameters

The serialupdateparameters function in hw/char/serial.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service divide-by-zero error and QEMU process crash via vectors involving a value of divider greater than baud base...

Qemu: net: rtl8139: infinite loop while transmit in C+ mode

The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...

Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy

The cirrusdocopy function in hw/display/cirrusvga.c in QEMU aka Quick Emulator, when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service divide-by-zero error and QEMU process crash via vectors involving blit pitch values...

Qemu: audio: intel-hda: infinite loop in processing dma buffer stream

The intelhdaxfer function in hw/audio/intel-hda.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption via an entry with the same value for buffer length and pointer position...

Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx

The xhcikickepctx function in hw/usb/hcd-xhci.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and QEMU process crash via vectors related to control transfer descriptor sequence...

Qemu: i386: leakage of stack memory to guest in kvmvapic.c

An information-exposure flaw was found in Quick Emulator QEMU in Task Priority Register TPR optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory...

Qemu: net: rtl8139: infinite loop while transmit in C+ mode

The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...

Qemu: usb: integer overflow in emulated_apdu_from_guest

An integer overflow flaw was found in Quick Emulator QEMU in the CCID Card device support. The flaw could occur while passing messages via command/response packets to and from the host. A privileged user inside a guest could use this flaw to crash the QEMU process...

QEMU Denial of Service Vulnerability (CNVD-2017-26591)

QEMU is an open source emulator software. QEMU suffers from a denial of service vulnerability. An attacker could exploit this issue to crash a QEMU instance, resulting in a denial of service condition...

[SECURITY] Fedora 25 Update: qemu-2.7.1-7.fc25

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

DEBIAN-CVE-2017-11434

The dhcpdecode function in slirp/bootp.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service out-of-bounds read and QEMU process crash via a crafted DHCP options string...

CVE-2017-11434

CVE-2017-11434 affects QEMU’s SLiRP networking: the dhcp_decode function in slirp/bootp.c can be triggered by a crafted DHCP options string, causing an out-of-bounds read and a QEMU process crash (Denial of Service) on local guests. The connected materials explicitly reference the function and th...

Heap overflow

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator Qemu 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service crash via vectors related to a VNC client updating its display after a VGA operation...

DEBIAN-CVE-2017-7980

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator Qemu 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service crash via vectors related to a VNC client updating its display after a VGA operation...

CVE-2017-7980

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator Qemu 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service crash via vectors related to a VNC client updating its display after a VGA operation...

CVE-2017-7980

CVE-2017-7980 detailed : A heap-based buffer overflow in QEMU’s Cirrus CLGD 54xx VGA Emulator (Cirrus CLGD 54xx) used with Quick Emulator/ QEMU up to version 2.8 enables a local privileged guest to execute arbitrary code or cause a denial of service by exploiting a vulnerability when a VNC client...