CVE-2013-4542: Improper Restriction of Operations within the Bounds of a Memory Buffer

The virtioscsiloadrequest function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access...

CVE-2014-3461: Improper Restriction of Operations within the Bounds of a Memory Buffer

hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."...

PT-2018-14299

Name of the Vulnerable Software and Affected Versions Qemu affected versions not specified Description The issue is related to a buffer overflow in the pcnet receive function located in hw/net/pcnet.c. This occurs due to the use of an incorrect integer data type. Recommendations At the moment,...

PT-2014-5810

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue concerns the mdp lut hw update function in the MDP display driver, which does not validate certain start and length values within an ioctl call. This allows attackers to gain privileges via a...

CVE-2014-5263

vmstatexhcievent in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATEENDOFLIST macro, which allows attackers to cause a denial of service out-of-bounds access, infinite loop, and memory corruption and possibly gain privileges via unspecified vectors...

CVE-2014-5263: Improper Restriction of Operations within the Bounds of a Memory Buffer

vmstatexhcievent in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATEENDOFLIST macro, which allows attackers to cause a denial of service out-of-bounds access, infinite loop, and memory corruption and possibly gain privileges via unspecified vectors...

PT-2014-6377

Name of the Vulnerable Software and Affected Versions QEMU version 1.6.0 Description The issue is related to the vmstate xhci event in hw/usb/hcd-xhci.c, which does not properly terminate the list with the VMSTATE END OF LIST macro. This allows attackers to cause a denial of service, including...

PT-2014-5343

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A use-after-free issue in the hw/pci/pcie.c file of QEMU allows local guest OS users to cause a denial of service, resulting in a QEMU instance crash. This can be achieved through hotplug and...

CVE-2013-4544

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to 1 RX or 2 TX queue numbers or 3 interrupt indices. NOTE: some of these details are obtained from third party information...

CVE-2013-4544: Improper Input Validation

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to 1 RX or 2 TX queue numbers or 3 interrupt indices. NOTE: some of these details are obtained from third party information...

CVE-2014-2894: Undefined Security Weakness

Off-by-one error in the cmdsmart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption...

CVE-2014-0150: Undefined Security Weakness

Integer overflow in the virtionethandlemac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow...

PT-2014-3522

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description A heap-based buffer overflow issue exists in the virtio load function, located in hw/virtio/virtio.c, which could potentially allow remote attackers to execute arbitrary code. This is achievable by...

CVE-2011-3346: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service guest crash via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has...

PT-2014-2815

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description The issue is related to a buffer overflow in the hw/pci/pcie aer.c file. This can be exploited by remote attackers to cause a denial of service and potentially execute arbitrary code. The exploitation i...

PT-2014-2814

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description The issue is related to a buffer overflow in the hw/timer/hpet.c file. This might allow remote attackers to execute arbitrary code via vectors related to the number of timers. Recommendations For versio...

PT-2014-2816

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description The issue is related to a buffer overflow in the hw/ssi/pl022.c file, which can be triggered by remote attackers sending crafted tx fifo head and rx fifo head values in a savevm image. This can cause a...

PT-2014-2826

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description The issue is related to the usb device post load function in hw/usb/bus.c, which might allow remote attackers to execute arbitrary code via a crafted savevm image. This is due to a negative setup len or...

PT-2014-3103

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description The issue is related to an array index error in the virtio load function, located in hw/virtio/virtio.c. This error allows remote attackers to execute arbitrary code via a crafted savevm image...

PT-2014-2820

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 1.7.2 Description A buffer overflow issue exists, allowing remote attackers to cause a denial of service or possibly execute arbitrary code. This issue is related to vectors involving IRQDest elements in the...