CVE-2020-25743

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an idecanceldmasync call...

CVE-2020-25743: NULL Pointer Dereference

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an idecanceldmasync call...

PT-2020-5261

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 5.1.1 Description The issue is related to a NULL pointer dereference in the QEMU hardware emulator. This can be triggered due to a lack of a pointer check before an ide cancel dma sync call. Exploitation of this issue ma...

PT-2020-5260

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 5.1.1 Description The issue is related to a NULL pointer dereference in the pci change irq level function in hw/pci/pci.c. This occurs because pci get bus might not return a valid pointer, potentially allowing an attacke...

CVE-2020-25742: NULL Pointer Dereference

pcichangeirqlevel in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pcigetbus might not return a valid pointer...

Null pointer dereference

fdctrlwritedata in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive...

CVE-2020-25741

fdctrlwritedata in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive...

CVE-2020-25741

fdctrlwritedata in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive...

CVE-2020-25741: NULL Pointer Dereference

fdctrlwritedata in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive...

CVE-2020-25625

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop...

CVE-2020-25085

QEMU 5.0.0 has a heap-based Buffer Overflow in flatviewreadcontinue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHCBLKSIZE case...

CVE-2020-25084

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usbpacketmap return value is not checked...

CVE-2020-25084: Use After Free

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usbpacketmap return value is not checked...

CVE-2020-25085: Out-of-bounds Write

QEMU 5.0.0 has a heap-based Buffer Overflow in flatviewreadcontinue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHCBLKSIZE case...

Denial Of Service (DoS)

qemu is vulnerable to denial of service DoS. The vulnerability exists through a large interval timer reload value in the rc4030write function of hw/dma/rc4030.c...

Use-After-Free

qemu is vulnerable to use-after-free. hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to for example a use-after-free outcome...

Denial Of Service (DoS)

QEMU is vulnerable to denial of service DoS. es1370transferaudio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370write operation...

Out Of Bound Access

In Qemu 3.0.0, lsidomsgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msglen value...

Malicious Package in hw-trnasport-u2f

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

CVE-2020-12829: Integer Overflow or Wraparound

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPYAREA macro while handling MMIO write operations through the sm5012denginewrite callback. A local attacker could abuse this flaw to crash the QEMU process in sm5012doperatio...