CVE-2016-6836: Improper Initialization

The vmxnet3completepacket function in hw/net/vmxnet3.c in QEMU aka Quick Emulator allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcqdescr object...

CVE-2016-6834: Buffer Copy without Checking Size of Input

The nettxpktdoswfragmentation function in hw/net/nettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via a zero length for the current fragment length...

PT-2016-5670

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue concerns improper bounds checking on banked access to video memory in the VGA module. This allows local guest OS administrators to execute arbitrary code on the host by changing access...

Double free

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service host OS crash or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability...

CVE-2010-3851: Exposure of Sensitive Information to an Unauthorized Actor

libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted 1 qcow2, 2 VMDK, or 3 VDI header, related to lack of support for a dis...