CVE-2016-1981

CVE-2016-1981 affects QEMU built with the e1000 NIC emulation. The issue is an infinite loop that can occur while processing data via transmit or receive descriptors when the initial TDH/RDH is outside the allocated descriptor buffer. A privileged user inside the guest could crash the QEMU instan...

CVE-2015-8745

CVE-2015-8745 affects QEMU with VMXNET3 paravirtual NIC emulation. Issue: reading Interrupt Mask Registers (IMR) can crash the QEMU process when exploited by a privileged guest (CAP_SYS_RAWIO), causing DoS. Connected data confirms the crash is tied to IMR access, not a remote exploit, and multipl...

CVE-2016-2198

CVE-2016-2198 affects QEMU when built with USB EHCI emulation. The root cause is a null pointer dereference in ehci_caps_write during writes to EHCI capability registers, which could be triggered by a privileged user inside the guest and may crash the QEMU process, causing a DoS. Technical detail...

CVE-2015-8744

CVE-2015-8744 affects QEMU when built with a VMXNET3 paravirtual NIC; the issue arises from improper/layer-2 header handling for very small frames (less than 22 bytes), which could be exploited by a privileged guest to crash the QEMU process and cause DoS. Public details in Debian/related advisor...

CVE-2016-9845

CVE-2016-9845 affects QEMU with Virtio GPU Device emulator support. The vulnerability arises when processing the VIRTIO_GPU_CMD_GET_CAPSET_INFO command, allowing a guest user/process to leak contents of host memory. The issue is described as an information leak in virgl_cmd_get_capset_info, tied ...

CVE-2015-8817

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...

CVE-2016-1981

QEMU aka Quick Emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head TDH/RDH is set outside the allocated descriptor buffer. A...

UBUNTU-CVE-2016-9916

Memory leak in hw/9pfs/9p-proxy.c in QEMU aka Quick Emulator allows local privileged guest OS users to cause a denial of service host memory consumption and possibly QEMU process crash by leveraging a missing cleanup operation in the proxy backend...

UBUNTU-CVE-2016-9913

Memory leak in the v9fsdeviceunrealizecommon function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local privileged guest OS users to cause a denial of service host memory consumption and possibly QEMU process crash via vectors involving the order of resource cleanup...

UBUNTU-CVE-2016-9776

QEMU aka Quick Emulator built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcffecreceive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading t...

Debian DLA-765-1 : qemu-kvm security update

Multiple vulnerabilities have been found in qemu-kvm : CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory,...

[SECURITY] [DLA 765-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in qemu-kvm: CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing pack...

QEMU 'VIRTIO_GPU_CMD_SET_SCANOUT()' function out of bounds denial of service vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. An out-of-bounds denial of service vulnerability exists in the QEMU 'VIRTIOGPUCMDSETSCANOUT' function. An attacker could exploit this...

DLA-765-1 qemu-kvm - security update

Bulletin has no description...

CVE-2016-9912

Quick Emulator Qemu built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtiogpuresourcedestroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host...

CVE-2016-9923

Quick Emulator Qemu built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS...

CVE-2016-9921

Quick emulator Qemu built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host,...

CVE-2016-9911

Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...

CVE-2016-9921

Quick emulator Qemu built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host,...

Input validation

Quick emulator Qemu built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host,...