QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in modesensepage if the 'page' argument was set to MODEPAGEALLS 0x3f. A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service conditio...

CVE-2017-12809

QEMU aka Quick Emulator, when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash by flushing an empty CDROM device drive...

Null pointer dereference

QEMU aka Quick Emulator, when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash by flushing an empty CDROM device drive...