Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-2608-1
HistoryMay 13, 2015 - 12:00 a.m.

QEMU vulnerabilities

2015-05-1300:00:00
ubuntu.com
40

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.9 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.011 Low

EPSS

Percentile

84.3%

JSON

Releases

  • Ubuntu 15.04
  • Ubuntu 14.10
  • Ubuntu 14.04 ESM
  • Ubuntu 12.04

Packages

  • qemu - Machine emulator and virtualizer
  • qemu-kvm - Machine emulator and virtualizer

Details

Jason Geffner discovered that QEMU incorrectly handled the virtual floppy
driver. This issue is known as VENOM. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-3456)

Daniel P. Berrange discovered that QEMU incorrectly handled VNC websockets.
A remote attacker could use this issue to cause QEMU to consume memory,
resulting in a denial of service. This issue only affected Ubuntu 14.04
LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779)

Jan Beulich discovered that QEMU, when used with Xen, didn’t properly
restrict access to PCI command registers. A malicious guest could use this
issue to cause a denial of service. This issue only affected Ubuntu 14.04
LTS and Ubuntu 14.10. (CVE-2015-2756)

OSVersionArchitecturePackageVersionFilename
Ubuntu15.04noarchqemu-system< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-guest-agent< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-guest-agent-dbgsym< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-kvm< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-system-arm< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-system-arm-dbgsym< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-system-common< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-system-common-dbgsym< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Ubuntu15.04noarchqemu-system-mips< 1:2.2+dfsg-5expubuntu9.1UNKNOWN
Rows per page:
1-10 of 861

Related

openvas 47
securityvulns 3
nessus 59
osv 5
debian 5
suse 10
fedora 6
ibm 4
prion 3
centos 5
redhat 11
freebsd 3
veracode 2
oraclelinux 5
mageia 3
cve 3
debiancve 3
ubuntucve 3
checkpoint_security 1
archlinux 1
fortinet 1
lenovo 2
altlinux 1
huawei 1
myhack58 1
f5 2
threatpost 3
arista 1
xen 2
symantec 1
thn 2
openvas
openvas
Ubuntu: Security Advisory (USN-2608-1)
2015-06-09 00:00:00
Debian Security Advisory DSA 3259-1 (qemu - security update)
2015-05-13 00:00:00
Debian: Security Advisory (DSA-3259-1)
2015-05-12 00:00:00
securityvulns
securityvulns
[USN-2608-1] QEMU vulnerabilities
2015-05-17 00:00:00
libvirt / qemu security vulnerabilities
2015-05-17 00:00:00
[ MDVSA-2015:210 ] qemu
2015-05-05 00:00:00
nessus
nessus
Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2608-1)
2015-05-13 00:00:00
Debian DSA-3259-1 : qemu - security update (Venom)
2015-05-13 00:00:00
OracleVM 3.2 : xen (OVMSA-2015-0058) (Venom)
2015-05-15 00:00:00
osv
osv
qemu - security update
2015-05-13 00:00:00
virtualbox - security update
2015-05-28 00:00:00
qemu - security update
2015-06-19 00:00:00
debian
debian
[SECURITY] [DSA 3259-1] qemu security update
2015-05-13 16:07:57
[SECURITY] [DLA 248-1] qemu security update
2015-06-19 15:05:33
[SECURITY] [DSA 3274-1] virtualbox security update
2015-05-28 21:17:43
suse
suse
Security update for qemu (important)
2015-05-18 17:05:01
Security update for kvm (important)
2015-05-13 22:04:49
Security update for KVM (important)
2015-05-16 00:04:49
fedora
fedora
[SECURITY] Fedora 21 Update: qemu-2.1.3-7.fc21
2015-05-17 06:38:09
[SECURITY] Fedora 22 Update: qemu-2.3.0-0.3.rc2.fc22
2015-04-21 18:50:53
[SECURITY] Fedora 21 Update: qemu-2.1.3-8.fc21
2015-06-21 00:16:05
ibm
ibm
Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779)
2018-06-18 01:28:03
Security Bulletin: Venom vulnerability affects IBM Flex System Manager (FSM) (CVE-2015-3456)
2019-01-31 02:10:01
Security Bulletin:Venom qemu vulnerability affects PowerKVM (CVE-2015-3456)
2018-06-18 01:28:20
prion
prion
Design/Logic Flaw
2016-01-12 19:59:00
Out-of-bounds
2015-05-13 18:59:00
Command injection
2015-04-01 14:59:00
centos
centos
libcacard, qemu security update
2015-10-28 09:28:27
xen security update
2015-05-13 15:16:55
qemu security update
2015-05-13 15:37:07
redhat
redhat
(RHSA-2015:1943) Moderate: qemu-kvm security update
2015-10-27 00:00:00
(RHSA-2015:1931) Moderate: qemu-kvm-rhev security update
2015-10-26 18:09:05
(RHSA-2015:1011) Important: rhev-hypervisor security update
2015-05-15 00:00:00
freebsd
freebsd
qemu -- denial of service vulnerability
2015-03-23 00:00:00
qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")
2015-04-29 00:00:00
xen-tools -- Unmediated PCI command register access in qemu
2015-03-31 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-01-15 09:08:08
Denial Of Service (DoS)
2019-01-15 09:05:54
oraclelinux
oraclelinux
qemu-kvm security update
2015-10-27 00:00:00
xen security update
2015-05-13 00:00:00
qemu-kvm security update
2015-05-13 00:00:00
mageia
mageia
Updated qemu packages fix security vulnerabilities
2015-04-15 12:01:28
Updated virtualbox packages fix security vulnerabilities
2015-05-15 21:23:49
Updated qemu packages fix CVE-2015-3456
2015-05-13 18:54:07
cve
cve
CVE-2015-1779
2016-01-12 19:59:00
CVE-2015-3456
2015-05-13 18:59:00
CVE-2015-2756
2015-04-01 14:59:00
debiancve
debiancve
CVE-2015-1779
2016-01-12 19:59:00
CVE-2015-2756
2015-04-01 14:59:00
CVE-2015-3456
2015-05-13 18:59:00
ubuntucve
ubuntucve
CVE-2015-1779
2015-03-25 00:00:00
CVE-2015-3456
2015-05-13 00:00:00
CVE-2015-2756
2015-04-01 00:00:00
checkpoint_security
checkpoint_security
Check Point response to CVE-2015-3456 (VENOM)
2015-05-12 21:00:00
archlinux
archlinux
qemu: arbitrary code execution
2015-05-14 00:00:00
fortinet
fortinet
CVE-2015-3456 "VENOM" vulnerability
2015-05-19 00:00:00
lenovo
lenovo
Venom
2017-01-23 00:00:00
Venom - Lenovo Support US
2017-01-23 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 7 package qemu version 1.4.0-alt1.1.M70P.1
2015-05-15 00:00:00
huawei
huawei
Security Advisory - VENOM Vulnerability in Huawei Products
2015-06-09 00:00:00
myhack58
myhack58
Vulnerability warning:“venom（VENOM”the vulnerability affects millions worldwide virtual machine security-vulnerability warning-the black bar safety net
2015-05-15 00:00:00
f5
f5
K16620 : QEMU vulnerability CVE-2015-3456
2015-10-03 00:00:00
SOL16620 - QEMU vulnerability CVE-2015-3456
2015-05-13 00:00:00
threatpost
threatpost
Oracle Patches VENOM Vulnerability
2015-05-18 10:49:00
Flaw in Virtualization Software Could Lead to VM Escapes, Data Theft
2015-05-13 09:34:43
Oracle Patches Java Zero Day
2015-07-15 09:44:12
arista
arista
Security Advisory 0010
2015-05-14 00:00:00
xen
xen
Privilege escalation via emulated floppy disk drive
2015-05-13 11:15:00
Unmediated PCI command register access in qemu
2015-03-31 12:00:00
symantec
symantec
SA95 : VENOM Vulnerability in Virtualization Platforms
2015-05-15 08:00:00
thn
thn
Venom Vulnerability Exposes Most Data Centers to Cyber Attacks
2015-05-14 05:32:00
Why You Should Consider QEMU Live Patching
2021-09-23 11:16:00

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

8.9 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.011 Low

EPSS

Percentile

84.3%

JSON
Related for USN-2608-1
openvas47securityvulns3nessus59osv5debian5suse10fedora6ibm4prion3centos5redhat11freebsd3veracode2oraclelinux5mageia3cve3debiancve3ubuntucve3checkpoint_security1archlinux1fortinet1lenovo2altlinux1huawei1myhack581f52threatpost3arista1xen2symantec1thn2