QEMU Denial of Service Vulnerability (CNVD-2016-03443)

QEMU is a suite of analog processor software. A security vulnerability in the esp.c file in QEMU's scsi when the program uses the ESP/NCR53C9x controller emulation support allows attackers to conduct denial-of-service attacks exploiting this vulnerability...

[SECURITY] Fedora 22 Update: qemu-2.3.1-14.fc22

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

UBUNTU-CVE-2016-4439

The espregwrite function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller FSC support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash or potentially execute arbitrary code o...

[SECURITY] Fedora 23 Update: qemu-2.4.1-9.fc23

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

DEBIAN-CVE-2016-3712

Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service out-of-bounds read and QEMU process crash by editing VGA registers in VBE mode...

[SECURITY] [DSA 3573-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3573-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 09, 2016 https://www.debian.org/security/faq -...

qemu: incorrect banked access bounds checking in vga module

An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions VBE support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU...

Fedora 24 : xen-4.6.1-6.fc24 (2016-48e72b7bc5)

x86 shadow pagetables: address width overflow XSA-173, CVE-2016-3960 Qemu: net: buffer overflow in stellarisenet emulator CVE-2016-4001 Qemu: net: buffer overflow in MIPSnet emulator CVE-2016-4002 qemu: Infinite loop vulnerability in usbehci using siTD process CVE-2016-4037 Note that Tenable...

UBUNTU-CVE-2016-3712

Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service out-of-bounds read and QEMU process crash by editing VGA registers in VBE mode...

Fedora 22 : xen-4.5.3-2.fc22 (2016-75063477ca)

x86 shadow pagetables: address width overflow XSA-173, CVE-2016-3960 Qemu: net: buffer overflow in stellarisenet emulator CVE-2016-4001 Qemu: net: buffer overflow in MIPSnet emulator CVE-2016-4002 qemu: Infinite loop vulnerability in usbehci using siTD process CVE-2016-4037 Note that Tenable...

Fedora 23 : xen-4.5.3-2.fc23 (2016-35d7b09908)

x86 shadow pagetables: address width overflow XSA-173, CVE-2016-3960 Qemu: net: buffer overflow in stellarisenet emulator CVE-2016-4001 Qemu: net: buffer overflow in MIPSnet emulator CVE-2016-4002 qemu: Infinite loop vulnerability in usbehci using siTD process CVE-2016-4037 Note that Tenable...

UBUNTU-CVE-2016-4002

Buffer overflow in the mipsnetreceive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service memory corruption and QEMU crash or possibly execute arbitrary code via a packet larger than 1514 bytes...

Texas Instruments Calculators Emulator 3.03 Buffer Overflow

!/usr/bin/perl This exploit uses command line arguments for different offsets So it can be tested on different systems NIX Flavours Texas Instruments Emulator exploit Version: 3.03-nogdb+dfsg-3 As discussed here previously: https://www.exploit-db.com/exploits/39692/ And here...

CVE-2016-1340

Heap-based buffer overflow in Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted libclimeta.so filename arguments, aka Bug ID CSCux68837...

CVE-2016-1339

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

CVE-2016-1339

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

Command injection

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

CVE-2016-1339

Cisco Unified Computing System UCS Platform Emulator 2.52TS4, 3.02cA, and 3.02cTS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832...

CVE-2016-1340

Cisco UCS Platform Emulator (UCSPE) versions 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 are affected by a heap-based buffer overflow when handling libclimeta.so filename arguments. Root cause: improper validation of the libclimeta.so filename, enabling local privilege escalation. Impact: local users can...

CVE-2016-1339

Cisco UCS Platform Emulator (UCSPE) versions 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 are affected by CVE-2016-1339 due to improper handling of ucspe-copy command-line arguments, enabling local privilege escalation via crafted arguments. Root cause: insecure command-line argument processing allowing a...