17 matches found
CVE-2026-77913
hw/display/vga: fix text-mode OOB write after a graphics surface switch...
Oracle Linux 9 : qemu-kvm (ELSA-2024-12674)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12674 advisory. - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs Philippe Mathieu-Daude Orabug: 36869694 CVE-2024-3446 - hw/char/virtio-serial-bus: Protec...
CVE-2020-27616: Incorrect Calculation
ati2dblt in hw/display/ati2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process...
CVE-2020-12829: Integer Overflow or Wraparound
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPYAREA macro while handling MMIO write operations through the sm5012denginewrite callback. A local attacker could abuse this flaw to crash the QEMU process in sm5012doperatio...
QEMU Denial of Service Vulnerability (CNVD-2020-36746)
QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A security vulnerability exists in the ati-vga of the hw/display/ati.c file in QEMU version 4.2.0. An attacker can exploit th...
CVE-2019-15034: Buffer Copy without Checking Size of Input
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...
QEMU: qxl: null pointer dereference while releasing spice resources
interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...
CVE-2019-12155
interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...
CVE-2019-12155: NULL Pointer Dereference
interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...
CVE-2017-15289: Out-of-bounds Write
The mode4and5 write functions in hw/display/cirrusvga.c in Qemu allow local OS guest privileged users to cause a denial of service out-of-bounds write access and Qemu process crash via vectors related to dst calculation...
CVE-2016-9922: Divide By Zero
The cirrusdocopy function in hw/display/cirrusvga.c in QEMU aka Quick Emulator, when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service divide-by-zero error and QEMU process crash via vectors involving blit pitch values...
CVE-2017-5857: Missing Release of Memory after Effective Lifetime
Memory leak in the virglcmdresourceunref function in hw/display/virtio-gpu-3d.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service host memory consumption via a large number of VIRTIOGPUCMDRESOURCEUNREF commands sent without detaching the backing storage beforehan...
CVE-2017-5578: Missing Release of Memory after Effective Lifetime
Memory leak in the virtiogpuresourceattachbacking function in hw/display/virtio-gpu.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service host memory consumption via a large number of VIRTIOGPUCMDRESOURCEATTACHBACKING commands...
CVE-2016-10028: Out-of-bounds Read
The virglcmdgetcapset function in hw/display/virtio-gpu-3d.c in QEMU aka Quick Emulator built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service out-of-bounds read and process crash via a VIRTIOGPUCMDGETCAPSET command with a maximum capabilities size...
PT-2016-7460
Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator affected versions not specified Description A memory leak issue exists, allowing local guest OS administrators to cause a denial of service through excessive memory consumption. This is achieved by sending a large numbe...
Command injection
The vmsvgafiforun function in hw/display/vmwarevga.c in QEMU allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via a VGA command...