Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3125-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3125-1 advisory. Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A privileged attacker inside the guest could use this issue to cause...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)

qemu was updated to fix 29 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

QEMU memory misreference vulnerability (CNVD-2016-06750)

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A memory misreference vulnerability exists in QEMU built with VMWARE VMXNET3 NIC device support. An attacker could exploit this vulnerability to cause a QEMU virtual...

Cloud Security Series: 360GearTeam again found QEMU multiple vulnerabilities-vulnerability warning-the black bar safety net

! 2 0 1 6 years and 8 months or so, the odd Tiger 3 6 0 to the QEMU official report a number of QEMU vulnerabilities in. They allow an attacker to attack a virtual machine or the host machine itself, causing a denial of service or arbitrary code execution. 360GearTeamoriginal 3 6 0 cloud security...

CVE-2016-6836

Quick Emulator QEMU built with the VMWARE VMXNET3 NIC device support is vulnerable to an information leakage issue. The vulnerability could occur while processing the transmittx queue when it reaches the end of a packet. A privileged user inside guest could use this vulnerability to leak host...

CVE-2016-6836

The vmxnet3completepacket function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcqdescr object...

PT-2016-7131

Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator affected versions not specified Description The issue allows local guest OS administrators to obtain sensitive host memory information. This is due to a failure to initialize the txcq descr object in the vmxnet3 complet...

CVE-2016-6833

Use-after-free vulnerability in the vmxnet3iobar0write function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service QEMU instance crash by leveraging failure to check if the device is active...

PT-2016-7128 · Qemu Team +3 · Qemu +3

Name of the Vulnerable Software and Affected Versions: QEMU aka Quick Emulator affected versions not specified Description: A use-after-free issue in the vmxnet3 io bar0 write function allows local guest OS administrators to cause a denial of service by crashing the QEMU instance. This is due to ...

UBUNTU-CVE-2016-6836

The vmxnet3completepacket function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcqdescr object...

UBUNTU-CVE-2016-6833

Use-after-free vulnerability in the vmxnet3iobar0write function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service QEMU instance crash by leveraging failure to check if the device is active...

QEMU 'hw/net/vmxnet3.c' Denial of Service Vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A denial-of-service vulnerability exists in QEMU 'hw/net/vmxnet3.c', which allows attackers to exploit the vulnerability to crash the application, resulting in a denial...

Security update for qemu (important)

qemu was updated to fix 29 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avoi...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)

qemu was updated to fix 37 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

Fedora 23 : qemu-2.4.1-5.fc23 (2016-e9bba2bb01)

CVE-2015-7549: pci: NULL pointer dereference issue bz 1291138 CVE-2015-8558: DoS by infinite loop in ehciadvancestate bz 1291309 CVE-2015-8666: Heap-based buffer overrun during VM migration bz 1294027 CVE-2015-8744: vmxnet3: fix crash with short packets bz 1295440 CVE-2015-8745: vmxnet3: don't...

Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)

CVE-2015-8745: vmxnet3: don't assert reading registers in bar0 bz 1295442 CVE-2015-8567: net: vmxnet3: host memory leakage bz 1289818 CVE-2016-1922: i386: avoid NULL pointer dereference bz 1292766 CVE-2015-8613: buffer overflow in megasasctrlgetinfo bz 1284008 CVE-2015-8701: Buffer overflow in...

Fedora 22 : xen-4.5.2-7.fc22 (2016-e1784417af)

PV superpage functionality missing sanity checks XSA-167, CVE-2016-1570 VMX: intercept issue with INVLPG on non-canonical address XSA-168, CVE-2016-1571 Qemu: pci: NULL pointer dereference issue CVE-2015-7549 qemu: DoS by infinite loop in ehciadvancestate CVE-2015-8558 qemu: Heap-based buffer...

Debian Security Advisory DSA 3471-1 (qemu - security update)

Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tan...

Ubuntu: Security Advisory (USN-2891-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2891-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2891-1 advisory. Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An attacker inside the guest could use this issue to cause QEMU to crash,...