Out-of-bounds

The virtioscsiloadrequest function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access...

Buffer overflow

Buffer overflow in the pxa2xxsspload function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-rxlevel value in a savevm image...

Heap overflow

Heap-based buffer overflow in the virtioload function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image...

Integer overflow

Integer signedness error in the virtionetload function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow...

Buffer overflow

Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted txfifohead and rxfifohead values in a savevm image...

Buffer overflow

Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpregvmstatearraylen in a savevm image...

Buffer overflow

Multiple buffer overflows in the tsc210xload function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted 1 precision, 2 nextprecision, 3 function, or 4 nextfunction value in a savevm image...

CVE-2013-4533

Buffer overflow in the pxa2xxsspload function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-rxlevel value in a savevm image...

CVE-2013-4542

CVE-2013-4542 affects QEMU up to version 1.7.2, where virtio_scsi_load_request in hw/scsi/scsi-bus.c could be triggered by a crafted savevm image, causing an out-of-bounds access and potentially arbitrary code execution. Impact is linked to remote attackers via savevm/data state handling; vendor ...

CVE-2013-4151

The vulnerability CVE-2013-4151 affects QEMU 1.x before 1.7.2, where the virtio_load path in virtio/virtio.c can be triggered by a crafted savevm image. This leads to an out-of-bounds write, enabling remote code execution on the host when a guest state is loaded. Root cause: insufficient validati...

CVE-2013-4151

The virtioload function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write...

CVE-2013-4541

CVE-2013-4541 affects QEMU: usb_device_post_load in hw/usb/bus.c (pre-1.7.2) may allow remote code execution via a crafted savevm image, due to a negative setup_len or setup_index. Affected: QEMU before 1.7.2. Impact: arbitrary code execution. Remediation: upgrade to 1.7.2 or newer. The documents...

CVE-2013-4530

Affected software: QEMU before 1.7.2. Vulnerable component: hw/ssi/pl022.c. Issue: buffer overflow via crafted tx_fifo_head and rx_fifo_head in a savevm image, enabling denial of service and potentially arbitrary code execution. Impact: remote attacker could cause QEMU to crash or run arbitrary c...

CVE-2014-0182

Heap-based buffer overflow in the virtioload function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image...

CVE-2013-4537

The ssisdtransfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image...

CVE-2013-4540

CVE-2013-4540 affects QEMU’s savevm handling: a buffer overflow in scoop_gpio_handler_update (in QEMU before 1.7.2) can allow remote code execution via crafted values in a savevm image (prev_level, gpio_level, or gpio_dir). Affected product/component: QEMU, vulnerable function: scoop_gpio_handler...

CVE-2013-4542

The virtioscsiloadrequest function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access...

CVE-2013-4151

The virtioload function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write...

CVE-2013-4529

Buffer overflow in hw/pci/pcieaer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large lognum value in a savevm image...

CVE-2013-4538

Multiple buffer overflows in the ssd0323load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via crafted 1 cmdlen, 2 row, or 3 col values; 4 rowstart and rowend values; or 5 colstar and...