ALPINE-CVE-2016-7995

Memory leak in the ehciprocessitd function in hw/usb/hcd-ehci.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption via a large number of crafted buffer page select PG indexes...

DEBIAN-CVE-2016-7157

The 1 mptsasconfigmanufacturing1 and 2 mptsasconfigioc0 functions in hw/scsi/mptconfig.c in QEMU aka Quick Emulator allow local guest OS administrators to cause a denial of service QEMU process crash via vectors involving MPTSASCONFIGPACK...

DEBIAN-CVE-2016-6888

Integer overflow in the nettxpktinit function in hw/net/nettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service QEMU process crash via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference...

CVE-2016-6834

CVE-2016-6834 affects QEMU (net_tx_pkt_do_sw_fragmentation in hw/net/net_tx_pkt.c). The issue allows a local guest OS administrator to trigger a denial of service by sending a zero-length current fragment length, causing an infinite loop and QEMU process crash. Connected documents confirm this CV...

CVE-2016-6888

CVE-2016-6888 in QEMU (net_tx_pkt_init in hw/net/net_tx_pkt.c) has an integer overflow when handling the maximum fragmentation count, triggering an unchecked multiplication and a NULL pointer dereference. This allows a local privileged user/guest to cause a denial of service (QEMU process crash)....

CVE-2016-7422

CVE-2016-7422 affects QEMU’s virtio/virtio.c: virtqueue_map_desc allows a local guest OS administrator to trigger a NULL pointer dereference by using a large I/O descriptor buffer length, leading to QEMU process crash. Remediation in connected docs shows fixes via rebases to QEMU 2.9.0 (RHSA-2017...

CVE-2016-4964

CVE-2016-4964 : In QEMU, the mptsas_fetch_requests function (hw/scsi/mptsas.c) allows a local guest OS administrator to trigger a denial of service via vectors involving s->state, potentially causing an infinite loop, CPU exhaustion, or QEMU process crash. The provided documents do not specify...

CVE-2016-6888

Integer overflow in the nettxpktinit function in hw/net/nettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service QEMU process crash via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference...

CVE-2016-6835

The vmxnettxpktparseheaders function in hw/net/vmxnettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service buffer over-read by leveraging failure to check IP header length...

ALPINE-CVE-2016-9106

Memory leak in the v9fswrite function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption by leveraging failure to free an IO vector...

ALPINE-CVE-2016-9105

Memory leak in the v9fslink function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption via vectors involving a reference to the source fid object...

DEBIAN-CVE-2016-9105

Memory leak in the v9fslink function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption via vectors involving a reference to the source fid object...

ALPINE-CVE-2016-9104

Multiple integer overflows in the 1 v9fsxattrread and 2 v9fsxattrwrite functions in hw/9pfs/9p.c in QEMU aka Quick Emulator allow local guest OS administrators to cause a denial of service QEMU process crash via a crafted offset, which triggers an out-of-bounds access...

DEBIAN-CVE-2016-9102

Memory leak in the v9fsxattrcreate function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash via a large number of Txattrcreate messages with the same fid number...

CVE-2016-9101

CVE-2016-9101 affects QEMU’s i8255x (PRO100) NIC emulation in hw/net/eepro100.c. A memory leak can be triggered by repeatedly unplugging the NIC, causing memory consumption and QEMU process crash (DoS) from a local privileged user. Public advisories (Debian, SUSE, IBM PowerKVM) confirm the issue ...

CVE-2016-9105

CVE-2016-9105 applies to QEMU, describing a memory leak in the v9fs_link function of hw/9pfs/9p.c that can be triggered by a reference to the source fid object, leading to denial of service via memory consumption. The IBM PowerKVM bulletin notes a fix in PowerKVM: version 3.1.0.2 (and PowerKVM 2....

CVE-2016-9103

CVE-2016-9103 affects QEMU’s 9pfs/v9fs_xattrcreate in hw/9pfs/9p.c. The vulnerability allows local authenticated guests to obtain sensitive host heap memory information by reading xattribute values before writing to them. Technical context and host-memory disclosure are supported by connected sou...

CVE-2016-9102

CVE-2016-9102 is a memory-leak vulnerability in QEMU's 9pfs/9p.c v9fs_xattrcreate path. The issue allows a local privileged user (guest) to trigger memory consumption escalating to a DoS by sending a large number of Txattrcreate messages with the same fid. Affected component: hw/9pfs/9p.c (v9fs_x...

CVE-2016-9911

Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...

Debian Security Advisory DSA 3729-1 (xen - security update)

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-7777 XSA-190 Jan Beulich from SUSE discovered that Xen does not properly honor CR0.TS and CR0.EM for x86 HVM guests, potentially allowi...