ALPINE-CVE-2017-12136

Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service free list corruption and host crash or gain privileges on the host via vectors involving maptrack free list handling...

DEBIAN-CVE-2017-12135

Xen allows local OS guest users to cause a denial of service crash or possibly obtain sensitive information or gain privileges via vectors involving transitive grants...

CVE-2017-12136

CVE-2017-12136 affects Xen 4.6.x–4.9.x. The issue is a race condition in grant table maptrack free list handling, enabling a malicious guest administrator to crash the host or escalate privileges to the host. Public advisories (GLSA 201801-14; SUSE SU-2017:2327-2) document the fix as Xen upgrades...

UBUNTU-CVE-2017-12134

The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability...

CVE-2017-12809

QEMU aka Quick Emulator, when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash by flushing an empty CDROM device drive...

Qemu: char: divide by zero error in serial_update_parameters

The serialupdateparameters function in hw/char/serial.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service divide-by-zero error and QEMU process crash via vectors involving a value of divider greater than baud base...

DEBIAN-CVE-2017-11434

The dhcpdecode function in slirp/bootp.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service out-of-bounds read and QEMU process crash via a crafted DHCP options string...

CVE-2017-8379

Memory leak in the keyboard input event handlers support in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service host memory consumption by rapidly generating large keyboard events...

CVE-2017-8112

hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and CPU consumption via the message ring page count...

CVE-2017-8086

Memory leak in the v9fslistxattr function in hw/9pfs/9p-xattr.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service memory consumption via vectors involving the origvalue variable...

DEBIAN-CVE-2015-8345

The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service application crash and infinite loop via vectors involving the command block list...

CVE-2015-8568

Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service host memory consumption by trying to activate the vmxnet3 device repeatedly...

DEBIAN-CVE-2015-8613

Stack-based buffer overflow in the megasasctrlgetinfo function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service QEMU instance crash via a crafted SCSI controller CTRLGETINFO command...

Design/Logic Flaw

The 1 v9fscreate and 2 v9fslcreate functions in hw/9pfs/9p.c in QEMU aka Quick Emulator allow local guest OS privileged users to cause a denial of service file descriptor or memory consumption via vectors related to an already in-use fid...

CVE-2017-5973

The xhcikickepctx function in hw/usb/hcd-xhci.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and QEMU process crash via vectors related to control transfer descriptor sequence...

Out-of-bounds

The sdhcisdmatransfermultiblocks function in hw/sd/sdhci.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service out-of-bounds heap access and crash or execute arbitrary code on the QEMU host via vectors involving the data transfer length...

Null pointer dereference

The utilformatispureuint function in vrendrenderer.c in Virgil 3d project aka virglrenderer 0.6.0 and earlier allows local guest OS users to cause a denial of service NULL pointer dereference via a crafted VIRGLCCMDCLEAR command...

CVE-2017-5937

The utilformatispureuint function in vrendrenderer.c in Virgil 3d project aka virglrenderer 0.6.0 and earlier allows local guest OS users to cause a denial of service NULL pointer dereference via a crafted VIRGLCCMDCLEAR command...

CVE-2017-5937

The utilformatispureuint function in vrendrenderer.c in Virgil 3d project aka virglrenderer 0.6.0 and earlier allows local guest OS users to cause a denial of service NULL pointer dereference via a crafted VIRGLCCMDCLEAR command...

CVE-2017-5937

The utilformatispureuint function in vrendrenderer.c in Virgil 3d project aka virglrenderer 0.6.0 and earlier allows local guest OS users to cause a denial of service NULL pointer dereference via a crafted VIRGLCCMDCLEAR command...