3770 matches found
Design/Logic Flaw
The imxfecdotx function in hw/net/imxfec.c in QEMU aka Quick Emulator does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via vectors involving a buffer descript...
CVE-2016-7909
The pcnetrdraaddr function in hw/net/pcnet.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by setting the 1 receive or 2 transmit descriptor ring length to 0...
CVE-2016-7909
CVE-2016-7909 affects QEMU pcnet.c (pcnet_rdra_addr): local admin can trigger an infinite loop and crash QEMU by setting the receive or transmit descriptor ring length to 0. Public advisories (e.g., Fedora FEDORA-2017-12394e2cc7 and Debian DLA-1599-1) include fixes/updates; apply vendor patches o...
CVE-2016-7908
The mcffecdotx function in hw/net/mcffec.c in QEMU aka Quick Emulator does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via vectors involving a buffer descript...
CVE-2016-7909
The pcnetrdraaddr function in hw/net/pcnet.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by setting the 1 receive or 2 transmit descriptor ring length to 0...
PT-2016-7346
Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator versions affected versions not specified Description The issue is related to a memory leak in the usb xhci exit function, which can be triggered by local guest OS administrators when the xhci uses msix. This can cause a...
CVE-2016-7422
The virtqueuemapdesc function in hw/virtio/virtio.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via a large I/O descriptor buffer length value...
CVE-2016-7421
The pvscsiringpopreqdescr function in hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by leveraging failure to limit process IO loop to the ring size...
CVE-2016-7170
The vmsvgafiforun function in hw/display/vmwarevga.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash via vectors related to cursor.mask and cursor.image array sizes when processing a DEFINECURSOR svga command...
PT-2016-7241
Name of the Vulnerable Software and Affected Versions QEMU aka Quick Emulator affected versions not specified Description The issue allows local guest OS administrators to cause a denial of service, resulting in an infinite loop and QEMU process crash. This is due to an incorrect cast in the pvsc...
CVE-2016-7156
The pvscsiconvertsglist function in hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by leveraging an incorrect cast...
CVE-2016-6351
The espdodma function in hw/scsi/esp.c in QEMU aka Quick Emulator, when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash or execute arbitrary code on the QEMU host via vectors involvi...
CVE-2016-7157
The 1 mptsasconfigmanufacturing1 and 2 mptsasconfigioc0 functions in hw/scsi/mptconfig.c in QEMU aka Quick Emulator allow local guest OS administrators to cause a denial of service QEMU process crash via vectors involving MPTSASCONFIGPACK...
PT-2016-6952
Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description The issue allows local guest OS administrators to cause a denial of service, resulting in an infinite loop and QEMU process crash, by specifying a zero length for the descriptor buffer in the...
CVE-2016-6834
The nettxpktdoswfragmentation function in hw/net/nettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via a zero length for the current fragment length...
Silicon Graphics LibTIFF Information Disclosure Vulnerability
Silicon Graphics LibTiff is a library for reading and writing TIFF Tagged Image File Format files from the U.S. company Silicon Graphics. The library contains a number of command-line tools to deal with TIFF files. An information disclosure vulnerability exists in the libtiff/tifread.c file in...
ALPINE-CVE-2016-5403
The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...
Design/Logic Flaw
The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...
CVE-2016-5403
The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...
CVE-2016-5403
The virtqueuepop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service memory consumption and QEMU process crash by submitting requests without waiting for completion...