CVE-2020-25624: Out-of-bounds Read

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver...

CVE-2017-6505: Loop with Unreachable Exit Condition

The ohciserviceedlist function in hw/usb/hcd-ohci.c in QEMU aka Quick Emulator before 2.9.0 allows local guest OS users to cause a denial of service infinite loop via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330...

CVE-2016-2391: NULL Pointer Dereference

The ohcibusstart function in the USB OHCI emulation support hw/usb/hcd-ohci.c in QEMU allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via vectors related to multiple eoftimers...