853 matches found
CVE-2018-20216
QEMU can have an infinite loop in hw/rdma/vmw/pvrdmadevring.c because return values are not checked and -1 is mishandled...
CVE-2018-20126
hw/rdma/vmw/pvrdmacmd.c in QEMU allows createcq and createqp memory leaks because errors are mishandled...
CVE-2018-20124: Out-of-bounds Read
hw/rdma/rdmabackend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large numsge value...
CVE-2018-20216: Unchecked Return Value
QEMU can have an infinite loop in hw/rdma/vmw/pvrdmadevring.c because return values are not checked and -1 is mishandled...
CVE-2018-20125: NULL Pointer Dereference
hw/rdma/vmw/pvrdmacmd.c in QEMU allows attackers to cause a denial of service NULL pointer dereference or excessive memory allocation in createcqring or createqprings...
CVE-2018-20123
pvrdmarealize in hw/rdma/vmw/pvrdmamain.c in QEMU has a Memory leak after an initialisation error...
CVE-2018-20123
pvrdmarealize in hw/rdma/vmw/pvrdmamain.c in QEMU has a Memory leak after an initialisation error...
CVE-2018-19364
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to for example a use-after-free outcome...
PT-2018-3507
Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue is related to the pvrdma idx ring has function in the PVRDMA emulator of QEMU, which can lead to an infinite loop due to an unreachable exit condition. This can be exploited by a...
PT-2018-3503
Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue is related to the hw/rdma/rdma backend.c component in QEMU, which allows guest OS users to trigger out-of-bounds access. This can be achieved via a PvrdmaSqWqe ring element with a...
CVE-2018-19489: Concurrent Execution using Shared Resource with Improper Synchronization
v9fswstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service crash because of a race condition during file renaming...
CVE-2018-19364: Use After Free
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to for example a use-after-free outcome...
CVE-2018-16867: Concurrent Execution using Shared Resource with Improper Synchronization
A flaw was found in qemu Media Transfer Protocol MTP before version 3.1.0. A path traversal in the in usbmtpwritedata function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lea...
PT-2018-19024
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a possible out of bounds write due to a race condition in the easelcomm hw build scatterlist function. This could lead to local escalation of privilege, with System privileges required for...
openSUSE Security Update : dpdk (openSUSE-2018-1484)
This update for dpdk to version 16.11.8 provides the following security fix : - CVE-2018-1059: restrict untrusted guest to misuse virtio to corrupt host application ovs-dpdk memory which could have lead all VM to lose connectivity bsc1089638 and following non-security fixes : - Enable the broadco...
CVE-2018-19364
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to for example a use-after-free outcome...
CVE-2018-18954: Out-of-bounds Read
The pnvlpcdoeccb function in hw/ppc/pnvlpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory...
PT-2018-3376
Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue is related to the hw/9pfs/cofile.c and hw/9pfs/9p.c components in QEMU, where a race condition can occur, allowing a thread to modify an fid path while it is being accessed by anothe...
PT-2018-3378
Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 3.1 Description: The issue is related to the pnv lpc do eccb function in the QEMU emulator, specifically in the hw/ppc/pnv lpc.c file. It involves a buffer data boundary read issue. Exploitation of this issue could allo...