2612 matches found
Design/Logic Flaw
QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...
DEBIAN-CVE-2015-8701
QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...
CVE-2015-8701
QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...
CVE-2015-8701
CVE-2015-8701 affects QEMU with Rocker switch emulation. Affected path is tx_consume processing of TX descriptors; if a descriptor has more than ROCKER_TX_FRAGS_MAX (16) fragments, an off-by-one error can cause memory leakage on the host or crash the QEMU process, leading to DoS. Exploitation det...
CVE-2015-8701
QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...
CVE-2016-2198
QEMU aka Quick Emulator built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting ...
CVE-2016-1981
QEMU aka Quick Emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head TDH/RDH is set outside the allocated descriptor buffer. A...
CVE-2016-2197
QEMU aka Quick Emulator built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure FIS and Command List Block CLB entries. A privileged user inside guest could use this flaw to crash the QEMU process instanc...
CVE-2016-2198
QEMU aka Quick Emulator built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting ...
CVE-2016-1981: Loop with Unreachable Exit Condition
QEMU aka Quick Emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head TDH/RDH is set outside the allocated descriptor buffer. A...
CVE-2015-8743: Out-of-bounds Read
QEMU aka Quick Emulator built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged CAPSYSRAWIO user/process could use this flaw to leak or corrupt QEMU memory bytes...
CVE-2016-2198: NULL Pointer Dereference
QEMU aka Quick Emulator built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting ...
CVE-2015-8701: Off-by-one Error
QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...
Fedora 25 : xen (2016-92e3ea2d1b)
two security flaws 1406840 x86 PV guests may be able to mask interrupts XSA-202, CVE-2016-10024 x86: missing NULL pointer check in VMFUNC emulation XSA-203, CVE-2016-10025 x86: Mishandling of SYSCALL singlestep during emulation XSA-204, CVE-2016-10013 1406260 Note that Tenable Network Security ha...
Debian DLA-765-1 : qemu-kvm security update
Multiple vulnerabilities have been found in qemu-kvm : CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory,...
[SECURITY] [DLA 765-1] qemu-kvm security update
Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in qemu-kvm: CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing pack...
DLA-765-1 qemu-kvm - security update
Bulletin has no description...
CVE-2016-9911
Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...
Design/Logic Flaw
Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...
DEBIAN-CVE-2016-9911
Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...