PT-2016-7652

Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator versions not specified Description The issue allows local guest OS administrators to obtain sensitive host heap memory information. This is achieved by reading xattribute values before writing to them, leveraging the v9...

PT-2016-7654

Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator versions prior to the fixed version Description A memory leak issue exists in the v9fs link function, located in hw/9pfs/9p.c, allowing local guest OS administrators to cause a denial of service by consuming memory. Thi...

PT-2016-7460

Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator affected versions not specified Description A memory leak issue exists, allowing local guest OS administrators to cause a denial of service through excessive memory consumption. This is achieved by sending a large numbe...

CVE-2015-8955

arch/arm64/kernel/perfevent.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service invalid pointer dereference via vectors involving events that are mishandled during a span of multiple HW PMUs...

Null pointer dereference

arch/arm64/kernel/perfevent.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service invalid pointer dereference via vectors involving events that are mishandled during a span of multiple HW PMUs...

CVE-2015-8955

arch/arm64/kernel/perfevent.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service invalid pointer dereference via vectors involving events that are mishandled during a span of multiple HW PMUs...

CVE-2015-8955

arch/arm64/kernel/perfevent.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service invalid pointer dereference via vectors involving events that are mishandled during a span of multiple HW PMUs...

Design/Logic Flaw

The imxfecdotx function in hw/net/imxfec.c in QEMU aka Quick Emulator does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via vectors involving a buffer descript...

CVE-2016-7907: Improper Input Validation

The imxfecdotx function in hw/net/imxfec.c in QEMU aka Quick Emulator does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via vectors involving a buffer descript...

CVE-2016-7908: Loop with Unreachable Exit Condition

The mcffecdotx function in hw/net/mcffec.c in QEMU aka Quick Emulator does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via vectors involving a buffer descript...

CVE-2016-6351

The espdodma function in hw/scsi/esp.c in QEMU aka Quick Emulator, when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash or execute arbitrary code on the QEMU host via vectors involvi...

CVE-2016-5106: Out-of-bounds Write

The megasasdcmdsetproperties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service out-of-bounds write access via vectors involving a MegaRAID Firmware Interface MFI command...

PT-2016-2663

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue is related to the virtqueue pop function in hw/virtio/virtio.c, which allows local guest OS administrators to cause a denial of service. This can be achieved by submitting requests...

CVE-2016-5403: Uncontrolled Resource Consumption

The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...

QEMU 'hw/scsi/esp.c' Remote Code Execution Vulnerability

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A remote code execution vulnerability exists in QEMU. An attacker could exploit this vulnerability to execute arbitrary code, which could also result in a denial of...

PT-2016-6836

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue allows local guest OS administrators to cause a denial of service or execute arbitrary code on the QEMU host. This is achieved through vectors involving DMA read into ESP command buffe...

CVE-2016-2392

The isrndis function in the USB Net device emulator hw/usb/dev-network.c in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via vectors...

CVE-2016-2538

Multiple integer overflows in the USB Net device emulator hw/usb/dev-network.c in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service QEMU process crash or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the 1...

CVE-2016-2841

The ne2000receive function in the NE2000 NIC emulation support hw/net/ne2000.c in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via crafted values for the PSTART and PSTOP registers, involving ring buffer control...

CVE-2016-2391: NULL Pointer Dereference

The ohcibusstart function in the USB OHCI emulation support hw/usb/hcd-ohci.c in QEMU allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via vectors related to multiple eoftimers...