853 matches found
CVE-2020-13361
In QEMU 5.0.0 and earlier, es1370transferaudio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370write operation...
PT-2020-6201
Name of the Vulnerable Software and Affected Versions QEMU versions 5.0.0 and earlier QEMU versions 4.2.0 Description The issue is related to an out-of-bounds read in the megasas lookup frame function in hw/scsi/megasas.c. This can be triggered via a crafted reply queue head field from a guest OS...
PT-2020-6200
Name of the Vulnerable Software and Affected Versions QEMU versions 4.2.0 through 5.0.0 Description The issue is related to a buffer data boundary operation overflow. It allows an attacker to compromise data integrity and cause a denial of service. The problem lies in the es1370 transfer audio...
CVE-2020-13361: Out-of-bounds Write
In QEMU 5.0.0 and earlier, es1370transferaudio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370write operation...
CVE-2020-13362: Out-of-bounds Read
In QEMU 5.0.0 and earlier, megasaslookupframe in hw/scsi/megasas.c has an out-of-bounds read via a crafted replyqueuehead field from a guest OS user...
CVE-2020-13253
sdwpaddr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhciwrite operations. A guest OS user can crash the QEMU process...
hw-egypt.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1172784 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2020-11102
hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length...
CVE-2020-11102
Technical details for CVE-2020-11102 (affected product, root cause, impact, and fix) are not provided in the connected documents. Monitor for official advisories and updated disclosures to assess risk and obtain remediation guidance.
CVE-2020-11102: Out-of-bounds Write
hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length...
PT-2020-6476
Name of the Vulnerable Software and Affected Versions QEMU version 4.2.0 Description The issue is related to a buffer overflow in the hw/net/tulip.c component of the QEMU hardware emulator. This occurs during the copying of tx/rx buffers because the frame size is not validated against the r/w dat...
CVE-2019-15034
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...
CVE-2019-15034: Buffer Copy without Checking Size of Input
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...
PT-2020-11407
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible out of bounds read in the fpc ta hw auth unwrap key function of fpc ta hw auth qsee.c. This could lead to local information disclosure, requiring System execution privileges for...
PT-2020-11381
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible out of bounds write in the get auth result function of fpc ta hw auth.c due to a missing bounds check. This could lead to local escalation of privilege, requiring System execution...
PT-2020-11408
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible out of bounds read in the authorize enrol function of fpc ta hw auth.c due to a missing bounds check. This could lead to local information disclosure, requiring System execution...
Tesla Autopilot Duped By 'Phantom' Images
Researchers said that autopilot systems used by popular cars – including the Tesla Model X – can be fooled into detecting fake images, projected by drones on the road or on surrounding billboards, as real. Attackers could potentially leverage this design hole to trigger the systems to brake or...
CVE-2015-6815
The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...
CVE-2015-6815: Loop with Unreachable Exit Condition
The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...
CVE-2015-5745
Buffer overflow in the sendcontrolmsg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service QEMU process crash via a crafted virtio control message...