ALT-BU-2024-1958-1
Branch sisyphus_e2k update bulletin.
Package atftp updated to version 0.8.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-00244
Уязвимость компонента tftpd_file.c клиента TFTP Atftp, связанная с копированием буфера без проверки входных данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05753
Уязвимость компонента options клиента TFTP Atftp, позволяющая нарушителю получить доступ к конфиденциальным данным
Modified: 2024-11-21
CVE-2021-41054
tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options.
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41054
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41054
- [debian-lts-announce] 20211117 [SECURITY] [DLA 2820-1] atftp security update
- [debian-lts-announce] 20211117 [SECURITY] [DLA 2820-1] atftp security update
- https://sourceforge.net/p/atftp/code/ci/d255bf90834fb45be52decf9bc0b4fb46c90f205/
- https://sourceforge.net/p/atftp/code/ci/d255bf90834fb45be52decf9bc0b4fb46c90f205/
Modified: 2024-11-21
CVE-2021-46671
options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client.
- https://bugs.debian.org/1004974
- https://bugs.debian.org/1004974
- [debian-lts-announce] 20220527 [SECURITY] [DLA 3028-1] atftp security update
- [debian-lts-announce] 20220527 [SECURITY] [DLA 3028-1] atftp security update
- https://sourceforge.net/p/atftp/code/ci/9cf799c40738722001552618518279e9f0ef62e5
- https://sourceforge.net/p/atftp/code/ci/9cf799c40738722001552618518279e9f0ef62e5
Closed bugs
atftp: Необходимо обеспечить совместимость службы с systemd
Package asciidoc updated to version 10.2.0-alt1 for branch sisyphus_e2k.
Closed bugs
SyntaxWarning: invalid escape sequence при генерации документации
Package qemu updated to version 7.2.0-alt3.E2K.3 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2017-00072
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю нарушить конфиденциальность, целостность и доступность
BDU:2017-00074
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему
BDU:2017-00646
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00647
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00648
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00649
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00650
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00651
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00652
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00653
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00654
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2017-00764
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00772
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-00773
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-01462
Уязвимость компонента hw/virtio/virtio-crypto.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2017-01782
Уязвимость компонента audio.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-01803
Уязвимость в qemu-nbd эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2017-02299
Уязвимость функции load_multiboot (hw/i386/multiboot.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код
BDU:2018-00003
Уязвимость процессоров Intel, ARM и AMD, связанная с особенностями функционирования модуля прогнозирования ветвлений, позволяющая нарушителю получить доступ к защищенной памяти из программы
BDU:2018-00025
Уязвимость функции v9fs_xattrwalk (hw/9pfs/9p.c) эмулятора аппаратного обеспечения Qemu, позволяющая нарушителю получить конфиденциальную информацию из памяти хостовой операционной системы
BDU:2018-00091
Уязвимость функции post_load (hw/input/ps2.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить чтение за границами буфера в динамической памяти
BDU:2018-00519
Уязвимость реализации VNC-сервера эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2018-01508
Уязвимость функции load_multiboot эмулятора аппаратного обеспечения Qemu, связанная с записью за границами буфера памяти, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2019-00222
Уязвимость сервера Qemu-NBD эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00716
Уязвимость функции vga_draw_text эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00721
Уязвимость эмулятора аппаратного обеспечения QEMU позволяет записывать данные за пределами заданного буфера, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-01957
Уязвимость процессоров Intel, связанная с микроархитектурной выборкой данных некэшируемой памяти (MDSUM), позволяющая нарушителю раскрыть защищаемую информацию
BDU:2019-01958
Уязвимость порта загрузки MLPDS микропрограммного обеспечения Intel, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2019-01959
Уязвимость процессоров Intel, связанная с восстановлением содержимого буферов заполнения (MFBDS), позволяющая нарушителю раскрыть защищаемую информацию
BDU:2019-01960
Уязвимость буфера данных MSBDS микропрограммного обеспечения Intel, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2019-03333
Уязвимость функции m_cat эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2019-04100
Уязвимость сервера Network Block Device (NBD) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04102
Уязвимость компонента io/channel-websock.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04104
Уязвимость функции mode4and5 (hw/display/cirrus_vga.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04122
Уязвимость компонента Virtio Vring эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04161
Уязвимость компонента ROUND_UP (n, d) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00698
Уязвимость компонентов hw/9pfs/cofile.c и hw/9pfs/9p.c эмулятора аппаратного обеспечения QEMU, связанная с повторным обращением к освобожденной области памяти, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00703
Уязвимость функций v9fs_wstat (hw/9pfs/9p.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00704
Уязвимость функции pnv_lpc_do_eccb (hw/ppc/pnv_lpc.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании и получить несанкционированный доступ к памяти PowerNV
BDU:2020-00749
Уязвимость реализации протокола qemu Media Transfer Protocol эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить несанкционированный доступ к информации
BDU:2020-00756
Уязвимость функции rtl8139_do_receive эмулятора аппаратного обеспечения QEMU, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00757
Уязвимость функции qmp_guest_file_read эмулятора аппаратного обеспечения QEMU, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-01462
Уязвимость функции ide_dma_cb() эмуляции аппаратного обеспечения различных платформ QEMU, связанная с недостаточной проверкой необычных или исключительных состояний, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03198
Уязвимость функции usb_mtp_write_data реализации протокола qemu Media Transfer Protocol эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2020-03199
Уязвимость функции pvrdma_realize виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03200
Уязвимость компонента hw/rdma/rdma_backend.c виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03201
Уязвимость компонента hw/rdma/vmw/pvrdma_cmd.c виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03202
Уязвимость функций create_cq и create_qp виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03203
Уязвимость функций uar_read и uar_write виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-03211
Уязвимость функции pvrdma_idx_ring_has_ виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-05682
Уязвимость протокола iSCSI эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2020-05805
Уязвимость функции xgmac_enet_send из hw/net/xgmac.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком механизма проверки размера копируемых данных, позволяющая нарушителю получить доступ к защищаемой информации, нарушить её целостность, а также вызвать отказ в обслуживании
BDU:2020-05894
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с разыменовыванием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-05895
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с разыменовыванием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-00070
Уязвимость программного обеспечения для эмуляции аппаратного обеспечения QEMU, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-00072
Уязвимость множества функцийи из hw/usb/core.c эмулятора аппаратного обеспечения QEMU, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-00073
Уязвимость функции net_tx_pkt_add_raw_fragment из hw/net/net_tx_pkt.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком использования функции assert(), позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-01265
Уязвимость функции ati_2d_blt (hw/display/ati_2d.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживаниии
BDU:2021-01313
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-01351
Уязвимость функции ati_mm_read из hw/display/ati.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-02091
Уязвимость процедуры sdhci_sdma_transfer_multi_blocks() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или аварийное завершение работы приложения, а так же выполнить произвольный код
BDU:2021-03332
Уязвимость функции virgl_cmd_get_capset компонента hw/display/virtio-gpu-3d.c эмулятора аппаратного обеспечения QEMU, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03347
Уязвимость компонента qemu-seccomp.c эмулятора аппаратного обеспечения QEMU, связанная с использованием неполного чёрного списка, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03350
Уязвимость функции virtio_gpu_set_scanout компонента hw/display/virtio-gpu.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком механизма освобождения памяти перед удалением последней ссылки, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03352
Уязвимость функции disas_insn компонента target/i386/translate.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком механизма управления генерацией кода, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-03451
Уязвимость подсистемы Bluetooth эмулятора аппаратного обеспечения QEMU, связанная с целочисленным переполнением значения, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03539
Уязвимость программного обеспечения для эмуляции аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании
BDU:2021-03540
Уязвимость программного обеспечения для эмуляции аппаратного обеспечения QEMU, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03673
Уязвимость функции ati_2d_blt() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05135
Уязвимость функции sm501_2d_operation из sm501.c эмулятора аппаратного обеспечения QEMU, связанная с целочисленным переполнением значения, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2021-05152
Уязвимость модуля flatview_read_continue() эмулятора аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-05169
Уязвимость компонента oss_write эмулятора аппаратного обеспечения QEMU, связанная с отсутствием проверки деления на ноль, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05172
Уязвимость сервера Network Block Device(NBD) эмулятора аппаратного обеспечения QEMU, связанная с неправильным учетом ресурсов внешних эмуляторов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05174
Уязвимость компонента hw/ppc/spapr.c эмулятора аппаратного обеспечения QEMU, связанная с недостатками разграничения доступа к портам, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2021-05193
Уязвимость компонента ati-vga эмулятора аппаратного обеспечения QEMU, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05207
Уязвимость компонента sd_wp_addr программы для эмуляции аппаратного обеспечения других платформ QEMU, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05249
Уязвимость функции ide_atapi_cmd_reply_end эмулятора аппаратного обеспечения QEMU, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании
BDU:2021-05255
Уязвимость реализации сервера 9pfs эмулятора аппаратного обеспечения QEMU, связанная с использованием памяти после её освобождения, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-05257
Уязвимость эмуляции USB EHCI эмулятора аппаратного обеспечения QEMU, связанная с неправильным учетом ресурсов внешних эмуляторов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-05312
Уязвимость API эмулятора аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-06303
Уязвимость функции virgl_cmd_get_capset_info() компонента contrib/vhost-user-gpu/virgl.c эмулятора аппаратного обеспечения QEMU, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2021-06305
Уязвимость компонентов contrib/vhost-user-gpu/vhost-user-gpu.c и contrib/vhost-user-gpu/virgl.c эмулятора аппаратного обеспечения QEMU, связанная с неправильным освобождением памяти перед удалением последний ссылки, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-06306
Уязвимость эмуляции устройства UAS эмулятора аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-06308
Уязвимость команды VIRTIO_GPU_CMD_GET_CAPSET эмулятора аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-01465
Уязвимость компонента virtio-fs (virtiofsd) эмулятора QEMU, позволяющая нарушителю повысить свои привилегии в системе
BDU:2022-03597
Уязвимость функции qxl_cursor() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код
BDU:2022-03599
Уязвимость функции lsi_do_msgout эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-04641
Уязвимость функции cursor_alloc() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2022-05645
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05685
Уязвимость демона virtio-fs эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05693
Уязвимость эмуляции USB-перенаправителя эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05700
Уязвимость адаптера хост-шины am53c974 SCSI эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05706
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с доступом к неинициализированному указателю, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05711
Уязвимость компонента security.capability эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05749
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05768
Уязвимость адаптера главной шины SCSI am53c974 эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05771
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с записью за границами буфера, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05772
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05775
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05778
Уязвимость запросов ввода-вывода SCSI функции mptsas_free_request() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05783
Уязвимость команды PVRDMA_CMD_CREATE_MR эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05784
Уязвимость команды ioport эмулятора аппаратного обеспечения QEMU, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05831
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05834
Уязвимость функции dwc2_handle_packet компонента hw/usb/hcd-dwc2.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05835
Уязвимость эмулятора сетевой карты vmxnet3 эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05839
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05840
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с выделением неограниченной памяти, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05847
Уязвимость устройства virtio-net эмулятора аппаратного обеспечения QEMU, связанная с неосвобождением ресурса после истечения действительного срока его эксплуатирования, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-05851
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с неосвобождением ресурса после истечения действительного срока его эксплуатирования, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-01705
Уязвимость функции fdctrl_transfer_handler() компонента hw/block/fdc.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании
BDU:2023-01716
Уязвимость устройства RDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2023-04792
Уязвимость компонента sdhci.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-04956
Уязвимость модуля of_dpa_cmd_add_l2_floo эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании и выполнить произвольный код
Modified: 2024-11-21
CVE-2016-10028
The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
- [oss-security] 20161220 CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities
- [oss-security] 20161220 CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities
- [oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities
- [oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities
- 94981
- 94981
- 1037525
- 1037525
- [qemu-devel] 20161214 [PATCH] display: virtio-gpu-3d: check virgl capabilities max_size
- [qemu-devel] 20161214 [PATCH] display: virtio-gpu-3d: check virgl capabilities max_size
- GLSA-201701-49
- GLSA-201701-49
Modified: 2024-11-21
CVE-2016-10155
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e
- [oss-security] 20170120 CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
- [oss-security] 20170120 CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
- [oss-security] 20170120 Re: CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
- [oss-security] 20170120 Re: CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb
- 95770
- 95770
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2016-7907
The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
- openSUSE-SU-2016:3237
- openSUSE-SU-2016:3237
- [oss-security] 20161003 CVE request Qemu: net: inifinte loop in imx_fec_do_tx() function
- [oss-security] 20161003 CVE request Qemu: net: inifinte loop in imx_fec_do_tx() function
- [oss-security] 20161003 Re: CVE request Qemu: net: inifinte loop in imx_fec_do_tx() function
- [oss-security] 20161003 Re: CVE request Qemu: net: inifinte loop in imx_fec_do_tx() function
- 93274
- 93274
- [qemu-devel] 20160922 [PATCH v2] net: imx: limit buffer descriptor count
- [qemu-devel] 20160922 [PATCH v2] net: imx: limit buffer descriptor count
- GLSA-201611-11
- GLSA-201611-11
Modified: 2024-11-21
CVE-2016-8667
The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.
- openSUSE-SU-2016:3237
- openSUSE-SU-2016:3237
- [oss-security] 20161014 CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick
- [oss-security] 20161014 CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick
- [oss-security] 20161015 Re: CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick
- [oss-security] 20161015 Re: CVE request Qemu: dma: rc4030 divide by zero error in set_next_tick
- 93567
- 93567
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20161012 [PATCH] dma: rc4030: limit interval timer reload value
- [qemu-devel] 20161012 [PATCH] dma: rc4030: limit interval timer reload value
Modified: 2024-11-21
CVE-2016-9602
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
- [oss-security] 20170117 CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem
- [oss-security] 20170117 CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem
- 95461
- 95461
- 1037604
- 1037604
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170130 [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink attacks
- [qemu-devel] 20170130 [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink attacks
- [qemu-devel] 20170220 [PATCH 00/29] 9pfs: local: fix vulnerability to symlink attacks
- [qemu-devel] 20170220 [PATCH 00/29] 9pfs: local: fix vulnerability to symlink attacks
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2016-9603
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
- 96893
- 96893
- 1038023
- 1038023
- RHSA-2017:0980
- RHSA-2017:0980
- RHSA-2017:0981
- RHSA-2017:0981
- RHSA-2017:0982
- RHSA-2017:0982
- RHSA-2017:0983
- RHSA-2017:0983
- RHSA-2017:0984
- RHSA-2017:0984
- RHSA-2017:0985
- RHSA-2017:0985
- RHSA-2017:0987
- RHSA-2017:0987
- RHSA-2017:0988
- RHSA-2017:0988
- RHSA-2017:1205
- RHSA-2017:1205
- RHSA-2017:1206
- RHSA-2017:1206
- RHSA-2017:1441
- RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603
- [debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update
- [debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201706-03
- GLSA-201706-03
- https://support.citrix.com/article/CTX221578
- https://support.citrix.com/article/CTX221578
Modified: 2024-11-21
CVE-2016-9908
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Modified: 2024-11-21
CVE-2016-9912
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Modified: 2024-11-21
CVE-2017-10664
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
- DSA-3920
- DSA-3920
- [oss-security] 20170629 CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort
- [oss-security] 20170629 CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort
- 99513
- 99513
- RHSA-2017:2390
- RHSA-2017:2390
- RHSA-2017:2445
- RHSA-2017:2445
- RHSA-2017:3466
- RHSA-2017:3466
- RHSA-2017:3470
- RHSA-2017:3470
- RHSA-2017:3471
- RHSA-2017:3471
- RHSA-2017:3472
- RHSA-2017:3472
- RHSA-2017:3473
- RHSA-2017:3473
- RHSA-2017:3474
- RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1466190
- https://bugzilla.redhat.com/show_bug.cgi?id=1466190
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [qemu-devel] 20170611 [PATCH] qemu-nbd: Ignore SIGPIPE
- [qemu-devel] 20170611 [PATCH] qemu-nbd: Ignore SIGPIPE
Modified: 2024-11-21
CVE-2017-10806
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
- DSA-3925
- DSA-3925
- [oss-security] 20170707 CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging
- [oss-security] 20170707 CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging
- 99475
- 99475
- https://bugzilla.redhat.com/show_bug.cgi?id=1468496
- https://bugzilla.redhat.com/show_bug.cgi?id=1468496
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170512 [PULL 2/6] usb-redir: fix stack overflow in usbredir_log_data
- [qemu-devel] 20170512 [PULL 2/6] usb-redir: fix stack overflow in usbredir_log_data
Modified: 2024-11-21
CVE-2017-11334
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.
- DSA-3925
- DSA-3925
- [oss-security] 20170717 CVE-2017-11334 Qemu: exec: oob access during dma operation
- [oss-security] 20170717 CVE-2017-11334 Qemu: exec: oob access during dma operation
- 99895
- 99895
- RHSA-2017:3369
- RHSA-2017:3369
- RHSA-2017:3466
- RHSA-2017:3466
- RHSA-2017:3470
- RHSA-2017:3470
- RHSA-2017:3471
- RHSA-2017:3471
- RHSA-2017:3472
- RHSA-2017:3472
- RHSA-2017:3473
- RHSA-2017:3473
- RHSA-2017:3474
- RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1471638
- https://bugzilla.redhat.com/show_bug.cgi?id=1471638
- [qemu-devel] 20170713 [PULL 21/41] exec: use qemu_ram_ptr_length to access guest ram
- [qemu-devel] 20170713 [PULL 21/41] exec: use qemu_ram_ptr_length to access guest ram
- USN-3575-1
- USN-3575-1
Modified: 2024-11-21
CVE-2017-11434
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
- DSA-3925
- DSA-3925
- [oss-security] 20170719 CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options
- [oss-security] 20170719 CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options
- 99923
- 99923
- https://bugzilla.redhat.com/show_bug.cgi?id=1472611
- https://bugzilla.redhat.com/show_bug.cgi?id=1472611
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170717 [PATCH] slirp: check len against dhcp options array end
- [qemu-devel] 20170717 [PATCH] slirp: check len against dhcp options array end
Modified: 2024-11-21
CVE-2017-12809
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
- DSA-3991
- DSA-3991
- [oss-security] 20170821 CVE-2017-12809 Qemu: ide: flushing of empty CDROM drives leads to NULL dereference
- [oss-security] 20170821 CVE-2017-12809 Qemu: ide: flushing of empty CDROM drives leads to NULL dereference
- 100451
- 100451
- [qemu-devel] 20170809 [Qemu-devel] [PATCH 1/2] IDE: Do not flush empty CDROM drives
- [qemu-devel] 20170809 [Qemu-devel] [PATCH 1/2] IDE: Do not flush empty CDROM drives
Modified: 2024-11-21
CVE-2017-13672
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- DSA-3991
- DSA-3991
- [oss-security] 20170830 CVE-2017-13672 Qemu: vga: OOB read access during display update
- [oss-security] 20170830 CVE-2017-13672 Qemu: vga: OOB read access during display update
- 100540
- 100540
- RHSA-2018:0816
- RHSA-2018:0816
- RHSA-2018:1104
- RHSA-2018:1104
- RHSA-2018:1113
- RHSA-2018:1113
- RHSA-2018:2162
- RHSA-2018:2162
- https://bugzilla.redhat.com/show_bug.cgi?id=1486560
- https://bugzilla.redhat.com/show_bug.cgi?id=1486560
- [qemu-devel] 20170824 [PATCH] vga: stop passing pointers to vga_draw_line* functions
- [qemu-devel] 20170824 [PATCH] vga: stop passing pointers to vga_draw_line* functions
- USN-3575-1
- USN-3575-1
Modified: 2024-11-21
CVE-2017-13673
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- [oss-security] 20170910 Re: CVE-2017-13673 Qemu: vga: reachable assert failure during during display update
- [oss-security] 20170910 Re: CVE-2017-13673 Qemu: vga: reachable assert failure during during display update
- 100527
- 100527
- RHSA-2018:1104
- RHSA-2018:1104
- RHSA-2018:1113
- RHSA-2018:1113
- https://git.qemu.org/gitweb.cgi?p=qemu.git%3Ba=commit%3Bh=bfc56535f793c557aa754c50213fc5f882e6482d
- https://git.qemu.org/gitweb.cgi?p=qemu.git%3Ba=commit%3Bh=bfc56535f793c557aa754c50213fc5f882e6482d
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04685.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04685.html
Modified: 2024-11-21
CVE-2017-13711
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
- DSA-3991
- DSA-3991
- [oss-security] 20170829 CVE-2017-13711 Qemu: Slirp: use-after-free when sending response
- [oss-security] 20170829 CVE-2017-13711 Qemu: Slirp: use-after-free when sending response
- 100534
- 100534
- RHSA-2018:0816
- RHSA-2018:0816
- RHSA-2018:1104
- RHSA-2018:1104
- RHSA-2018:1113
- RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=1486400
- https://bugzilla.redhat.com/show_bug.cgi?id=1486400
- [qemu-devel] 20170826 [PATCH] slirp: fix clearing ifq_so from pending packets
- [qemu-devel] 20170826 [PATCH] slirp: fix clearing ifq_so from pending packets
Modified: 2024-11-21
CVE-2017-14167
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
- DSA-3991
- DSA-3991
- [oss-security] 20170907 CVE-2017-14167 Qemu: i386: multiboot OOB access while loading guest kernel image
- [oss-security] 20170907 CVE-2017-14167 Qemu: i386: multiboot OOB access while loading guest kernel image
- 100694
- 100694
- RHSA-2017:3368
- RHSA-2017:3368
- RHSA-2017:3369
- RHSA-2017:3369
- RHSA-2017:3466
- RHSA-2017:3466
- RHSA-2017:3470
- RHSA-2017:3470
- RHSA-2017:3471
- RHSA-2017:3471
- RHSA-2017:3472
- RHSA-2017:3472
- RHSA-2017:3473
- RHSA-2017:3473
- RHSA-2017:3474
- RHSA-2017:3474
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170905 [PATCH] multiboot: validate multiboot header address values
- [qemu-devel] 20170905 [PATCH] multiboot: validate multiboot header address values
- USN-3575-1
- USN-3575-1
Modified: 2024-11-21
CVE-2017-15038
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
- [oss-security] 20171006 CVE-2017-15038 Qemu: 9p: virtfs: information disclosure when reading extended attributes
- [oss-security] 20171006 CVE-2017-15038 Qemu: 9p: virtfs: information disclosure when reading extended attributes
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20171004 Re: [PATCH] 9pfs: use g_malloc0 to allocate space for xattr
- [qemu-devel] 20171004 Re: [PATCH] 9pfs: use g_malloc0 to allocate space for xattr
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-15118
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- 101975
- 101975
- RHSA-2018:1104
- RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- USN-3575-1
- USN-3575-1
- 43194
- 43194
Modified: 2024-11-21
CVE-2017-15119
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS.
- http://www.openwall.com/lists/oss-security/2017/11/28/9
- http://www.openwall.com/lists/oss-security/2017/11/28/9
- 102011
- 102011
- RHSA-2018:1104
- RHSA-2018:1104
- RHSA-2018:1113
- RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-15124
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
Modified: 2024-11-21
CVE-2017-15268
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
- 101277
- 101277
- RHSA-2018:0816
- RHSA-2018:0816
- RHSA-2018:1104
- RHSA-2018:1104
- https://bugs.launchpad.net/qemu/+bug/1718964
- https://bugs.launchpad.net/qemu/+bug/1718964
- [qemu-devel] 20171010 [PATCH v1 1/7] io: monitor encoutput buffer size from websocket GSource
- [qemu-devel] 20171010 [PATCH v1 1/7] io: monitor encoutput buffer size from websocket GSource
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-15289
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
- [oss-security] 20171012 CVE-2017-15289 Qemu: cirrus: OOB access issue in mode4and5 write functions
- [oss-security] 20171012 CVE-2017-15289 Qemu: cirrus: OOB access issue in mode4and5 write functions
- 101262
- 101262
- RHSA-2017:3368
- RHSA-2017:3368
- RHSA-2017:3369
- RHSA-2017:3369
- RHSA-2017:3466
- RHSA-2017:3466
- RHSA-2017:3470
- RHSA-2017:3470
- RHSA-2017:3471
- RHSA-2017:3471
- RHSA-2017:3472
- RHSA-2017:3472
- RHSA-2017:3473
- RHSA-2017:3473
- RHSA-2017:3474
- RHSA-2017:3474
- RHSA-2018:0516
- RHSA-2018:0516
- https://bugzilla.redhat.com/show_bug.cgi?id=1501290
- https://bugzilla.redhat.com/show_bug.cgi?id=1501290
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20171011 [PATCH v2] cirrus: fix oob access in mode4and5 write functions
- [qemu-devel] 20171011 [PATCH v2] cirrus: fix oob access in mode4and5 write functions
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-16845
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
- 101923
- 101923
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20171116 [PATCH v2] ps2: check PS2Queue indices in post_load routine
- [qemu-devel] 20171116 [PATCH v2] ps2: check PS2Queue indices in post_load routine
- USN-3575-1
- USN-3575-1
- USN-3649-1
- USN-3649-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-17381
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
- [oss-security] 20171205 CVE-2017-17381 Qemu: virtio: divide by zero exception while updating rings
- [oss-security] 20171205 CVE-2017-17381 Qemu: virtio: divide by zero exception while updating rings
- 102059
- 102059
- [qemu-devel] 20171201 [PULL 6/7] virtio: check VirtQueue Vring object is set
- [qemu-devel] 20171201 [PULL 6/7] virtio: check VirtQueue Vring object is set
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-18030
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch.
- [oss-security] 20180115 CVE-2017-18030 Qemu: Out-of-bounds access in cirrus_invalidate_region routine
- [oss-security] 20180115 CVE-2017-18030 Qemu: Out-of-bounds access in cirrus_invalidate_region routine
- 102520
- 102520
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f153b563f8cf121aebf5a2fff5f0110faf58ccb3
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f153b563f8cf121aebf5a2fff5f0110faf58ccb3
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
Modified: 2024-11-21
CVE-2017-18043
Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).
- [oss-security] 20180119 CVE-2017-18043 Qemu: integer overflow in ROUND_UP macro could result in DoS
- [oss-security] 20180119 CVE-2017-18043 Qemu: integer overflow in ROUND_UP macro could result in DoS
- 102759
- 102759
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2098b073f398cd628c09c5a78537a6854
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2098b073f398cd628c09c5a78537a6854
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2017-2615
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
- RHSA-2017:0309
- RHSA-2017:0309
- RHSA-2017:0328
- RHSA-2017:0328
- RHSA-2017:0329
- RHSA-2017:0329
- RHSA-2017:0330
- RHSA-2017:0330
- RHSA-2017:0331
- RHSA-2017:0331
- RHSA-2017:0332
- RHSA-2017:0332
- RHSA-2017:0333
- RHSA-2017:0333
- RHSA-2017:0334
- RHSA-2017:0334
- RHSA-2017:0344
- RHSA-2017:0344
- RHSA-2017:0350
- RHSA-2017:0350
- RHSA-2017:0396
- RHSA-2017:0396
- RHSA-2017:0454
- RHSA-2017:0454
- [oss-security] 20170201 CVE-2017-2615 Qemu: display: cirrus: oob access while doing bitblt copy backward mode
- [oss-security] 20170201 CVE-2017-2615 Qemu: display: cirrus: oob access while doing bitblt copy backward mode
- 95990
- 95990
- 1037804
- 1037804
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170201 [PATCH v3] cirrus: fix oob access issue (CVE-2017-2615)
- [qemu-devel] 20170201 [PATCH v3] cirrus: fix oob access issue (CVE-2017-2615)
- GLSA-201702-27
- GLSA-201702-27
- GLSA-201702-28
- GLSA-201702-28
- https://support.citrix.com/article/CTX220771
- https://support.citrix.com/article/CTX220771
Modified: 2024-11-21
CVE-2017-2630
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
- [oss-security] 20170215 CVE-2017-2630 Qemu: nbd: oob stack write in client routine drop_sync
- [oss-security] 20170215 CVE-2017-2630 Qemu: nbd: oob stack write in client routine drop_sync
- 96265
- 96265
- RHSA-2017:2392
- RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
- [qemu-devel] 20170206 [PATCH 05/18] nbd/client: fix drop_sync
- [qemu-devel] 20170206 [PATCH 05/18] nbd/client: fix drop_sync
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2017-5525
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401
- [oss-security] 20170118 CVE request Qemu: audio: memory leakage in ac97 device
- [oss-security] 20170118 CVE request Qemu: audio: memory leakage in ac97 device
- [oss-security] 20170118 Re: CVE request Qemu: audio: memory leakage in ac97 device
- [oss-security] 20170118 Re: CVE request Qemu: audio: memory leakage in ac97 device
- 95671
- 95671
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5526
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
- [oss-security] 20170118 CVE request Qemu: audio: memory leakage in es1370 device
- [oss-security] 20170118 CVE request Qemu: audio: memory leakage in es1370 device
- [oss-security] 20170118 Re: CVE request Qemu: audio: memory leakage in es1370 device
- [oss-security] 20170118 Re: CVE request Qemu: audio: memory leakage in es1370 device
- 95669
- 95669
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
Modified: 2024-11-21
CVE-2017-5552
Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=33243031dad02d161225ba99d782616da133f689
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=33243031dad02d161225ba99d782616da133f689
- [oss-security] 20170120 CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing
- [oss-security] 20170120 CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing
- [oss-security] 20170120 Re: CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing
- [oss-security] 20170120 Re: CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing
- 95773
- 95773
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5578
Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=204f01b30975923c64006f8067f0937b91eea68b
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=204f01b30975923c64006f8067f0937b91eea68b
- [oss-security] 20170123 CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing
- [oss-security] 20170123 CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing
- [oss-security] 20170125 Re: CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing
- [oss-security] 20170125 Re: CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing
- 95781
- 95781
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5579
Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
- [oss-security] 20170124 CVE request Qemu: serial: host memory leakage in 16550A UART emulation
- [oss-security] 20170124 CVE request Qemu: serial: host memory leakage in 16550A UART emulation
- [oss-security] 20170125 Re: CVE request Qemu: serial: host memory leakage in 16550A UART emulation
- [oss-security] 20170125 Re: CVE request Qemu: serial: host memory leakage in 16550A UART emulation
- 95780
- 95780
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5667
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=42922105beb14c2fc58185ea022b9f72fb5465e9
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=42922105beb14c2fc58185ea022b9f72fb5465e9
- [oss-security] 20170130 CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- [oss-security] 20170130 CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- [oss-security] 20170131 Re: CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- [oss-security] 20170131 Re: CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- [oss-security] 20170212 Re: Re: CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- [oss-security] 20170212 Re: Re: CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer
- 95885
- 95885
- https://bugzilla.redhat.com/show_bug.cgi?id=1417559
- https://bugzilla.redhat.com/show_bug.cgi?id=1417559
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5715
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
- SUSE-SU-2018:0006
- SUSE-SU-2018:0006
- SUSE-SU-2018:0007
- SUSE-SU-2018:0007
- SUSE-SU-2018:0008
- SUSE-SU-2018:0008
- SUSE-SU-2018:0009
- SUSE-SU-2018:0009
- SUSE-SU-2018:0010
- SUSE-SU-2018:0010
- SUSE-SU-2018:0011
- SUSE-SU-2018:0011
- SUSE-SU-2018:0012
- SUSE-SU-2018:0012
- openSUSE-SU-2018:0013
- openSUSE-SU-2018:0013
- SUSE-SU-2018:0019
- SUSE-SU-2018:0019
- SUSE-SU-2018:0020
- SUSE-SU-2018:0020
- openSUSE-SU-2018:0022
- openSUSE-SU-2018:0022
- openSUSE-SU-2018:0023
- openSUSE-SU-2018:0023
- http://nvidia.custhelp.com/app/answers/detail/a_id/4609
- http://nvidia.custhelp.com/app/answers/detail/a_id/4609
- http://nvidia.custhelp.com/app/answers/detail/a_id/4611
- http://nvidia.custhelp.com/app/answers/detail/a_id/4611
- http://nvidia.custhelp.com/app/answers/detail/a_id/4613
- http://nvidia.custhelp.com/app/answers/detail/a_id/4613
- http://nvidia.custhelp.com/app/answers/detail/a_id/4614
- http://nvidia.custhelp.com/app/answers/detail/a_id/4614
- http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- VU#584653
- VU#584653
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- 102376
- 102376
- 1040071
- 1040071
- http://xenbits.xen.org/xsa/advisory-254.html
- http://xenbits.xen.org/xsa/advisory-254.html
- RHSA-2018:0292
- RHSA-2018:0292
- https://access.redhat.com/security/vulnerabilities/speculativeexecution
- https://access.redhat.com/security/vulnerabilities/speculativeexecution
- https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/
- https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/
- https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
- https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
- https://cert.vde.com/en-us/advisories/vde-2018-002
- https://cert.vde.com/en-us/advisories/vde-2018-002
- https://cert.vde.com/en-us/advisories/vde-2018-003
- https://cert.vde.com/en-us/advisories/vde-2018-003
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
- https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
- https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
- https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
- https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update
- [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update
- [debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update
- [debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security update
- [debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security update
- [debian-lts-announce] 20200320 [SECURITY] [DLA 2148-1] amd64-microcode security update
- [debian-lts-announce] 20200320 [SECURITY] [DLA 2148-1] amd64-microcode security update
- [debian-lts-announce] 20210816 [SECURITY] [DLA 2743-1] amd64-microcode security update
- [debian-lts-announce] 20210816 [SECURITY] [DLA 2743-1] amd64-microcode security update
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- FreeBSD-SA-18:03
- FreeBSD-SA-18:03
- FreeBSD-SA-19:26
- FreeBSD-SA-19:26
- GLSA-201810-06
- GLSA-201810-06
- https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
- https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
- https://security.netapp.com/advisory/ntap-20180104-0001/
- https://security.netapp.com/advisory/ntap-20180104-0001/
- https://security.paloaltonetworks.com/CVE-2017-5715
- https://security.paloaltonetworks.com/CVE-2017-5715
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr
- https://spectreattack.com/
- https://spectreattack.com/
- https://support.citrix.com/article/CTX231399
- https://support.citrix.com/article/CTX231399
- https://support.f5.com/csp/article/K91229003
- https://support.f5.com/csp/article/K91229003
- https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us
- https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_us
- https://support.lenovo.com/us/en/solutions/LEN-18282
- https://support.lenovo.com/us/en/solutions/LEN-18282
- 20180104 CPU Side-Channel Information Disclosure Vulnerabilities
- 20180104 CPU Side-Channel Information Disclosure Vulnerabilities
- USN-3531-1
- USN-3531-1
- USN-3531-3
- USN-3531-3
- USN-3540-2
- USN-3540-2
- USN-3541-2
- USN-3541-2
- USN-3542-2
- USN-3542-2
- USN-3549-1
- USN-3549-1
- USN-3560-1
- USN-3560-1
- USN-3561-1
- USN-3561-1
- USN-3580-1
- USN-3580-1
- USN-3581-1
- USN-3581-1
- USN-3581-2
- USN-3581-2
- USN-3582-1
- USN-3582-1
- USN-3582-2
- USN-3582-2
- USN-3594-1
- USN-3594-1
- USN-3597-1
- USN-3597-1
- USN-3597-2
- USN-3597-2
- USN-3620-2
- USN-3620-2
- USN-3690-1
- USN-3690-1
- USN-3777-3
- USN-3777-3
- USN-3516-1
- USN-3516-1
- DSA-4120
- DSA-4120
- DSA-4187
- DSA-4187
- DSA-4188
- DSA-4188
- DSA-4213
- DSA-4213
- 43427
- 43427
- VU#180049
- VU#180049
- https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001
- https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/
- https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/
- https://www.synology.com/support/security/Synology_SA_18_01
- https://www.synology.com/support/security/Synology_SA_18_01
- https://www.vmware.com/security/advisories/VMSA-2018-0007.html
- https://www.vmware.com/security/advisories/VMSA-2018-0007.html
- https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html
- https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html
- https://www.vmware.com/us/security/advisories/VMSA-2018-0004.html
- https://www.vmware.com/us/security/advisories/VMSA-2018-0004.html
Modified: 2024-11-21
CVE-2017-5856
Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=765a707000e838c30b18d712fe6cb3dd8e0435f3
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=765a707000e838c30b18d712fe6cb3dd8e0435f3
- [oss-security] 20170201 CVE request Qemu: scsi: megasas: host memory leakage in megasas_handle_dcmd
- [oss-security] 20170201 CVE request Qemu: scsi: megasas: host memory leakage in megasas_handle_dcmd
- [oss-security] 20170202 Re: CVE request Qemu: scsi: megasas: host memory leakage in megasas_handle_dcmd
- [oss-security] 20170202 Re: CVE request Qemu: scsi: megasas: host memory leakage in megasas_handle_dcmd
- 95999
- 95999
- https://bugzilla.redhat.com/show_bug.cgi?id=1418342
- https://bugzilla.redhat.com/show_bug.cgi?id=1418342
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5857
Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=5e8e3c4c75c199aa1017db816fca02be2a9f8798
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=5e8e3c4c75c199aa1017db816fca02be2a9f8798
- [oss-security] 20170201 CVE request Qemu: display: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref
- [oss-security] 20170201 CVE request Qemu: display: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref
- [oss-security] 20170202 Re: CVE request Qemu: display: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref
- [oss-security] 20170202 Re: CVE request Qemu: display: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref
- 95993
- 95993
- https://bugzilla.redhat.com/show_bug.cgi?id=1418382
- https://bugzilla.redhat.com/show_bug.cgi?id=1418382
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5898
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a
- SUSE-SU-2017:0570
- SUSE-SU-2017:0570
- SUSE-SU-2017:0582
- SUSE-SU-2017:0582
- [oss-security] 20170207 Re: CVE request Qemu: usb: integer overflow in emulated_apdu_from_guest
- [oss-security] 20170207 Re: CVE request Qemu: usb: integer overflow in emulated_apdu_from_guest
- 96112
- 96112
- RHSA-2017:1856
- RHSA-2017:1856
- RHSA-2017:2392
- RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1419699
- https://bugzilla.redhat.com/show_bug.cgi?id=1419699
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5931
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
- [oss-security] 20170207 Re: CVE request Qemu: virtio: integer overflow in handling virtio-crypto requests
- [oss-security] 20170207 Re: CVE request Qemu: virtio: integer overflow in handling virtio-crypto requests
- 96141
- 96141
- https://bugzilla.redhat.com/show_bug.cgi?id=1420092
- https://bugzilla.redhat.com/show_bug.cgi?id=1420092
- [qemu-devel] 20170110 [PULL 03/41] virtio-crypto: fix possible integer and heap overflow
- [qemu-devel] 20170110 [PULL 03/41] virtio-crypto: fix possible integer and heap overflow
- GLSA-201702-28
- GLSA-201702-28
Modified: 2024-11-21
CVE-2017-5973
The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=f89b60f6e5fee3923bedf80e82b4e5efc1bb156b
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=f89b60f6e5fee3923bedf80e82b4e5efc1bb156b
- [oss-security] 20170214 CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
- [oss-security] 20170214 CVE-2017-5973 Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
- 96220
- 96220
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1421626
- https://bugzilla.redhat.com/show_bug.cgi?id=1421626
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170206 [PATCH] xhci: apply limits to loops
- [qemu-devel] 20170206 [PATCH] xhci: apply limits to loops
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2017-5987
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=6e86d90352adf6cb08295255220295cf23c4286e
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=6e86d90352adf6cb08295255220295cf23c4286e
- [oss-security] 20170214 CVE-2017-5987 Qemu: sd: infinite loop issue in multi block transfers
- [oss-security] 20170214 CVE-2017-5987 Qemu: sd: infinite loop issue in multi block transfers
- 96263
- 96263
- https://bugzilla.redhat.com/show_bug.cgi?id=1421995
- https://bugzilla.redhat.com/show_bug.cgi?id=1421995
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170213 Re: [Qemu-devel] [PATCH v3 1/4] sd: sdhci: check transfer mode register in multi block transfer
- [qemu-devel] 20170213 Re: [Qemu-devel] [PATCH v3 1/4] sd: sdhci: check transfer mode register in multi block transfer
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2017-6058
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6
- [oss-security] 20170217 CVE-2017-6058 Qemu: net: vmxnet3: OOB NetRxPkt::ehdr_buf access when doing vlan stripping
- [oss-security] 20170217 CVE-2017-6058 Qemu: net: vmxnet3: OOB NetRxPkt::ehdr_buf access when doing vlan stripping
- 96277
- 96277
- 1037856
- 1037856
- https://bugzilla.redhat.com/show_bug.cgi?id=1423358
- https://bugzilla.redhat.com/show_bug.cgi?id=1423358
- [qemu-devel] 20170216 [PATCH 2/5] NetRxPkt: Fix memory corruption on VLAN header stripping
- [qemu-devel] 20170216 [PATCH 2/5] NetRxPkt: Fix memory corruption on VLAN header stripping
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2017-6505
The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb
- [oss-security] 20170306 CVE-2017-6505 Qemu: usb: an infinite loop issue in ohci_service_ed_list
- [oss-security] 20170306 CVE-2017-6505 Qemu: usb: an infinite loop issue in ohci_service_ed_list
- 96611
- 96611
- https://bugzilla.redhat.com/show_bug.cgi?id=1429432
- https://bugzilla.redhat.com/show_bug.cgi?id=1429432
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201704-01
- GLSA-201704-01
Modified: 2024-11-21
CVE-2017-7377
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d63fb193e71644a073b77ff5ac6f1216f2f6cf6e
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d63fb193e71644a073b77ff5ac6f1216f2f6cf6e
- [oss-security] 20170403 CVE-2017-7377 Qemu: 9pfs: host memory leakage via v9fs_create
- [oss-security] 20170403 CVE-2017-7377 Qemu: 9pfs: host memory leakage via v9fs_create
- 97319
- 97319
- https://bugzilla.redhat.com/show_bug.cgi?id=1437871
- https://bugzilla.redhat.com/show_bug.cgi?id=1437871
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170328 [PULL 1/2] 9pfs: fix file descriptor leak
- [qemu-devel] 20170328 [PULL 1/2] 9pfs: fix file descriptor leak
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-7471
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
- [oss-security] 20170419 CVE-2017-7471 Qemu: 9p: virtfs allows guest to change filesystem attributes on host
- [oss-security] 20170419 CVE-2017-7471 Qemu: 9p: virtfs allows guest to change filesystem attributes on host
- 97970
- 97970
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c0c060e
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c0c060e
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-7493
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
- [oss-security] 20170517 CVE-2017-7493 Qemu: 9pfs: guest privilege escalation in virtfs mapped-file mode
- [oss-security] 20170517 CVE-2017-7493 Qemu: 9pfs: guest privilege escalation in virtfs mapped-file mode
- 98574
- 98574
- https://bugzilla.redhat.com/show_bug.cgi?id=1451709
- https://bugzilla.redhat.com/show_bug.cgi?id=1451709
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170516 [PULL] 9pfs: local: forbid client access to metadata (CVE-2017-7493)
- [qemu-devel] 20170516 [PULL] 9pfs: local: forbid client access to metadata (CVE-2017-7493)
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-7539
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.
- [oss-security] 20170721 CVE-2017-7539 Qemu: qemu-nbd crashes due to undefined I/O coroutine
- [oss-security] 20170721 CVE-2017-7539 Qemu: qemu-nbd crashes due to undefined I/O coroutine
- 99944
- 99944
- RHSA-2017:2628
- RHSA-2017:2628
- RHSA-2017:3466
- RHSA-2017:3466
- RHSA-2017:3470
- RHSA-2017:3470
- RHSA-2017:3471
- RHSA-2017:3471
- RHSA-2017:3472
- RHSA-2017:3472
- RHSA-2017:3473
- RHSA-2017:3473
- RHSA-2017:3474
- RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7539
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7539
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=2b0bbc4f8809c972bad134bc1a2570dbb01dea0b
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=2b0bbc4f8809c972bad134bc1a2570dbb01dea0b
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=ff82911cd3f69f028f2537825c9720ff78bc3f19
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=ff82911cd3f69f028f2537825c9720ff78bc3f19
Modified: 2024-11-21
CVE-2017-7718
hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=215902d7b6fb50c6fc216fc74f770858278ed904
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=215902d7b6fb50c6fc216fc74f770858278ed904
- [oss-security] 20170419 CVE-2017-7718 Qemu: display: cirrus: OOB read access issue
- [oss-security] 20170419 CVE-2017-7718 Qemu: display: cirrus: OOB read access issue
- 97957
- 97957
- RHSA-2017:0980
- RHSA-2017:0980
- RHSA-2017:0981
- RHSA-2017:0981
- RHSA-2017:0982
- RHSA-2017:0982
- RHSA-2017:0983
- RHSA-2017:0983
- RHSA-2017:0984
- RHSA-2017:0984
- RHSA-2017:0988
- RHSA-2017:0988
- RHSA-2017:1205
- RHSA-2017:1205
- RHSA-2017:1206
- RHSA-2017:1206
- RHSA-2017:1430
- RHSA-2017:1430
- RHSA-2017:1431
- RHSA-2017:1431
- RHSA-2017:1441
- RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=1443441
- https://bugzilla.redhat.com/show_bug.cgi?id=1443441
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-8086
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ffcdef4277a91af15a3c09f7d16af072c29f3f2
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ffcdef4277a91af15a3c09f7d16af072c29f3f2
- [oss-security] 20170425 CVE-2017-8086 Qemu: 9pfs: host memory leakage via v9pfs_list_xattr
- [oss-security] 20170425 CVE-2017-8086 Qemu: 9pfs: host memory leakage via v9pfs_list_xattr
- 98012
- 98012
- https://bugzilla.redhat.com/show_bug.cgi?id=1444781
- https://bugzilla.redhat.com/show_bug.cgi?id=1444781
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170410 [PULL] 9pfs: xattr: fix memory leak in v9fs_list_xattr
- [qemu-devel] 20170410 [PULL] 9pfs: xattr: fix memory leak in v9fs_list_xattr
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-8112
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.
- [oss-security] 20170426 CVE-2017-8112 Qemu: scsi: vmw_pvscsi: infinite loop in pvscsi_log2
- [oss-security] 20170426 CVE-2017-8112 Qemu: scsi: vmw_pvscsi: infinite loop in pvscsi_log2
- 98015
- 98015
- https://bugzilla.redhat.com/show_bug.cgi?id=1445621
- https://bugzilla.redhat.com/show_bug.cgi?id=1445621
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170425 Re: [PATCH] vmw_pvscsi: check message ring page count at initialisation
- [qemu-devel] 20170425 Re: [PATCH] vmw_pvscsi: check message ring page count at initialisation
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-8284
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
Modified: 2024-11-21
CVE-2017-8309
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
- 98302
- 98302
- RHSA-2017:2408
- RHSA-2017:2408
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170428 [PATCH] audio: release capture buffers
- [qemu-devel] 20170428 [PATCH] audio: release capture buffers
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-8379
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
- [oss-security] 20170503 CVE-2017-8379 Qemu: input: host memory lekage via keyboard
- [oss-security] 20170503 CVE-2017-8379 Qemu: input: host memory lekage via keyboard
- 98277
- 98277
- RHSA-2017:2408
- RHSA-2017:2408
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20170428 [PATCH] input: limit kbd queue depth
- [qemu-devel] 20170428 [PATCH] input: limit kbd queue depth
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-9060
Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=dd248ed7e204ee8a1873914e02b8b526e8f1b80d
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=dd248ed7e204ee8a1873914e02b8b526e8f1b80d
- [oss-security] 20170519 CVE-2017-9060 Qemu: virtio-gpu: host memory leakage in Virtio GPU device
- [oss-security] 20170519 CVE-2017-9060 Qemu: virtio-gpu: host memory leakage in Virtio GPU device
- 98632
- 98632
- https://bugzilla.redhat.com/show_bug.cgi?id=1452597
- https://bugzilla.redhat.com/show_bug.cgi?id=1452597
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-9310
QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4154c7e03fa55b4cf52509a83d50d6c09d743b7
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4154c7e03fa55b4cf52509a83d50d6c09d743b7
- DSA-3920
- DSA-3920
- [oss-security] 20170531 CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation
- [oss-security] 20170531 CVE-2017-9310 Qemu: net: infinite loop in e1000e NIC emulation
- 98766
- 98766
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1452620
- https://bugzilla.redhat.com/show_bug.cgi?id=1452620
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-9330
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=26f670a244982335cc08943fb1ec099a2c81e42d
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=26f670a244982335cc08943fb1ec099a2c81e42d
- DSA-3920
- DSA-3920
- [oss-security] 20170601 CVE-2017-9330 Qemu: usb: ohci: infinite loop due to incorrect return value
- [oss-security] 20170601 CVE-2017-9330 Qemu: usb: ohci: infinite loop due to incorrect return value
- 98779
- 98779
- https://bugzilla.redhat.com/show_bug.cgi?id=1457697
- https://bugzilla.redhat.com/show_bug.cgi?id=1457697
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- GLSA-201706-03
- GLSA-201706-03
Modified: 2024-11-21
CVE-2017-9373
Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d68f0f778e7f4fbd674627274267f269e40f0b04
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d68f0f778e7f4fbd674627274267f269e40f0b04
- DSA-3920
- DSA-3920
- [oss-security] 20170605 CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug
- [oss-security] 20170605 CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug
- 98921
- 98921
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458270
- https://bugzilla.redhat.com/show_bug.cgi?id=1458270
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
Modified: 2024-11-21
CVE-2017-9374
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0
- DSA-3920
- DSA-3920
- [oss-security] 20170606 CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug
- [oss-security] 20170606 CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug
- 98905
- 98905
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
Modified: 2024-11-21
CVE-2017-9375
QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=96d87bdda3919bb16f754b3d3fd1227e1f38f13c
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=96d87bdda3919bb16f754b3d3fd1227e1f38f13c
- DSA-3991
- DSA-3991
- [oss-security] 20170605 CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep
- [oss-security] 20170605 CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep
- 98915
- 98915
- RHSA-2017:2392
- RHSA-2017:2392
- RHSA-2017:2408
- RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458744
- https://bugzilla.redhat.com/show_bug.cgi?id=1458744
- [debian-lts-announce] 20190920 [SECURITY] [DLA 1927-1] qemu security update
- [debian-lts-announce] 20190920 [SECURITY] [DLA 1927-1] qemu security update
Modified: 2024-11-21
CVE-2017-9503
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.
- [oss-security] 20170608 CVE-2017-9503 Qemu: scsi: null pointer dereference while processing megasas command
- [oss-security] 20170608 CVE-2017-9503 Qemu: scsi: null pointer dereference while processing megasas command
- 99010
- 99010
- https://bugzilla.redhat.com/show_bug.cgi?id=1459477
- https://bugzilla.redhat.com/show_bug.cgi?id=1459477
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- [qemu-devel] 20170606 [PATCH 4/7] megasas: do not read DCMD opcode more than once
- [qemu-devel] 20170606 [PATCH 4/7] megasas: do not read DCMD opcode more than once
- [qemu-devel] 20170606 [PATCH 7/7] megasas: always store SCSIRequest* into Megasas
- [qemu-devel] 20170606 [PATCH 7/7] megasas: always store SCSIRequest* into Megasas
Modified: 2024-11-21
CVE-2017-9524
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.
- DSA-3925
- DSA-3925
- [oss-security] 20170612 CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation
- [oss-security] 20170612 CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation
- 99011
- 99011
- RHSA-2017:1681
- RHSA-2017:1681
- RHSA-2017:1682
- RHSA-2017:1682
- RHSA-2017:2408
- RHSA-2017:2408
- [qemu-devel] 20170526 [PATCH] nbd: Fully initialize client in case of failed negotiation
- [qemu-devel] 20170526 [PATCH] nbd: Fully initialize client in case of failed negotiation
- [qemu-devel] 20170608 [PATCH] nbd: Fix regression on resiliency to port scan
- [qemu-devel] 20170608 [PATCH] nbd: Fix regression on resiliency to port scan
Modified: 2024-11-21
CVE-2018-10839
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
- RHSA-2019:2892
- RHSA-2019:2892
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [qemu-devel] 20180926 [PULL 21/25] ne2000: fix possible out of bound access in ne2000_receive
- [qemu-devel] 20180926 [PULL 21/25] ne2000: fix possible out of bound access in ne2000_receive
- USN-3826-1
- USN-3826-1
- DSA-4338
- DSA-4338
- [oss-security] 20181008 Qemu: integer overflow issues
- [oss-security] 20181008 Qemu: integer overflow issues
Modified: 2024-11-21
CVE-2018-11806
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
- [oss-security] 20180607 CVE-2018-11806 Qemu: slirp: heap buffer overflow while reassembling fragmented datagrams
- [oss-security] 20180607 CVE-2018-11806 Qemu: slirp: heap buffer overflow while reassembling fragmented datagrams
- 104400
- 104400
- RHSA-2018:2462
- RHSA-2018:2462
- RHSA-2018:2762
- RHSA-2018:2762
- RHSA-2018:2822
- RHSA-2018:2822
- RHSA-2018:2887
- RHSA-2018:2887
- RHSA-2019:2892
- RHSA-2019:2892
- https://bugzilla.redhat.com/show_bug.cgi?id=1586245
- https://bugzilla.redhat.com/show_bug.cgi?id=1586245
- [debian-lts-announce] 20190509 [SECURITY] [DLA 1781-1] qemu security update
- [debian-lts-announce] 20190509 [SECURITY] [DLA 1781-1] qemu security update
- [qemu-devel] 20180605 [PATCH 1/2] slirp: correct size computation while concatenating mbuf
- [qemu-devel] 20180605 [PATCH 1/2] slirp: correct size computation while concatenating mbuf
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3826-1
- USN-3826-1
- DSA-4454
- DSA-4454
- https://www.zerodayinitiative.com/advisories/ZDI-18-567/
- https://www.zerodayinitiative.com/advisories/ZDI-18-567/
Modified: 2024-11-21
CVE-2018-12126
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1805
- openSUSE-SU-2019:1805
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- RHSA-2019:1455
- RHSA-2019:1455
- RHSA-2019:2553
- RHSA-2019:2553
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- FEDORA-2019-1f5832fc0e
- FEDORA-2019-1f5832fc0e
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- FreeBSD-SA-19:26
- FreeBSD-SA-19:26
- GLSA-202003-56
- GLSA-202003-56
- USN-3977-3
- USN-3977-3
- DSA-4602
- DSA-4602
- FreeBSD-SA-19:07
- FreeBSD-SA-19:07
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.synology.com/security/advisory/Synology_SA_19_24
- https://www.synology.com/security/advisory/Synology_SA_19_24
Modified: 2024-11-21
CVE-2018-12127
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1805
- openSUSE-SU-2019:1805
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- RHSA-2019:1455
- RHSA-2019:1455
- RHSA-2019:2553
- RHSA-2019:2553
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- FEDORA-2019-1f5832fc0e
- FEDORA-2019-1f5832fc0e
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- FreeBSD-SA-19:26
- FreeBSD-SA-19:26
- GLSA-202003-56
- GLSA-202003-56
- USN-3977-3
- USN-3977-3
- DSA-4602
- DSA-4602
- FreeBSD-SA-19:07
- FreeBSD-SA-19:07
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.synology.com/security/advisory/Synology_SA_19_24
- https://www.synology.com/security/advisory/Synology_SA_19_24
Modified: 2024-11-21
CVE-2018-12130
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1805
- openSUSE-SU-2019:1805
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- RHSA-2019:1455
- RHSA-2019:1455
- RHSA-2019:2553
- RHSA-2019:2553
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- FEDORA-2019-1f5832fc0e
- FEDORA-2019-1f5832fc0e
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcu
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- FreeBSD-SA-19:26
- FreeBSD-SA-19:26
- GLSA-202003-56
- GLSA-202003-56
- USN-3977-3
- USN-3977-3
- DSA-4602
- DSA-4602
- FreeBSD-SA-19:07
- FreeBSD-SA-19:07
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.synology.com/security/advisory/Synology_SA_19_24
- https://www.synology.com/security/advisory/Synology_SA_19_24
Modified: 2024-11-21
CVE-2018-12617
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
- 104531
- 104531
- https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6
- https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6
- [debian-lts-announce] 20190228 [SECURITY] [DLA 1694-1] qemu security update
- [debian-lts-announce] 20190228 [SECURITY] [DLA 1694-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html
- https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3826-1
- USN-3826-1
- DSA-4454
- DSA-4454
- 44925
- 44925
Modified: 2024-11-21
CVE-2018-15746
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.
- [oss-security] 20180828 CVE-2018-15746 Qemu: seccomp: blacklist is not applied to all threads
- [oss-security] 20180828 CVE-2018-15746 Qemu: seccomp: blacklist is not applied to all threads
- RHSA-2019:2425
- RHSA-2019:2425
- [qemu-devel] 20180822 [PATCH v4 4/4] seccomp: set the seccomp filter to all threads
- [qemu-devel] 20180822 [PATCH v4 4/4] seccomp: set the seccomp filter to all threads
Modified: 2024-11-21
CVE-2018-16847
An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.
- 105866
- 105866
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16847
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16847
- https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg00200.html
- https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg00200.html
- USN-3826-1
- USN-3826-1
- [oss-security] 20181102 CVE-2018-16847 QEMU: nvme: Out-of-bounds r/w buffer access in cmb operations
- [oss-security] 20181102 CVE-2018-16847 QEMU: nvme: Out-of-bounds r/w buffer access in cmb operations
Modified: 2024-11-21
CVE-2018-16867
A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.
- 106195
- 106195
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16867
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16867
- FEDORA-2019-88a98ce795
- FEDORA-2019-88a98ce795
- USN-3923-1
- USN-3923-1
- [oss-security] 20181206 CVE-2018-16867 QEMU: dev-mtp: path traversal in usb_mtp_write_data of the Media Transfer Protocol (MTP)
- [oss-security] 20181206 CVE-2018-16867 QEMU: dev-mtp: path traversal in usb_mtp_write_data of the Media Transfer Protocol (MTP)
Modified: 2024-11-21
CVE-2018-16872
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- 106212
- 106212
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872
- [debian-lts-announce] 20190228 [SECURITY] [DLA 1694-1] qemu security update
- [debian-lts-announce] 20190228 [SECURITY] [DLA 1694-1] qemu security update
- FEDORA-2019-88a98ce795
- FEDORA-2019-88a98ce795
- FEDORA-2019-0664c7724d
- FEDORA-2019-0664c7724d
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3923-1
- USN-3923-1
- DSA-4454
- DSA-4454
Modified: 2024-11-21
CVE-2018-17958
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
- [oss-security] 20181008 Qemu: integer overflow issues
- [oss-security] 20181008 Qemu: integer overflow issues
- 105556
- 105556
- RHSA-2019:2425
- RHSA-2019:2425
- RHSA-2019:2553
- RHSA-2019:2553
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- [qemu-devel] 20180926 [PULL 22/25] rtl8139: fix possible out of bound access
- [qemu-devel] 20180926 [PULL 22/25] rtl8139: fix possible out of bound access
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3826-1
- USN-3826-1
- DSA-4454
- DSA-4454
Modified: 2024-11-21
CVE-2018-17962
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
- https://linux.oracle.com/cve/CVE-2018-17962.html
- https://access.redhat.com/security/cve/cve-2018-17962
- https://www.suse.com/security/cve/CVE-2018-17962/
- [oss-security] 20181008 Qemu: integer overflow issues
- [oss-security] 20181008 Qemu: integer overflow issues
- RHSA-2019:2892
- RHSA-2019:2892
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [qemu-devel] 20180926 [PULL 23/25] pcnet: fix possible buffer overflow
- [qemu-devel] 20180926 [PULL 23/25] pcnet: fix possible buffer overflow
- USN-3826-1
- USN-3826-1
- DSA-4338
- DSA-4338
Modified: 2024-11-21
CVE-2018-17963
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.
- [oss-security] 20181008 Qemu: integer overflow issues
- [oss-security] 20181008 Qemu: integer overflow issues
- RHSA-2019:2166
- RHSA-2019:2166
- RHSA-2019:2425
- RHSA-2019:2425
- RHSA-2019:2553
- RHSA-2019:2553
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update
- [qemu-devel] 20180926 [PULL 24/25] net: ignore packet size greater than INT_MAX
- [qemu-devel] 20180926 [PULL 24/25] net: ignore packet size greater than INT_MAX
- https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html
- https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html
- USN-3826-1
- USN-3826-1
- DSA-4338
- DSA-4338
Modified: 2024-11-21
CVE-2018-18954
The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- [oss-security] 20181107 CVE-2018-18954 QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb
- [oss-security] 20181107 CVE-2018-18954 QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb
- 105920
- 105920
- [Qemu-devel] 20181103 [PATCH v2] ppc/pnv: check size before data buffer access
- [Qemu-devel] 20181103 [PATCH v2] ppc/pnv: check size before data buffer access
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3826-1
- USN-3826-1
- DSA-4454
- DSA-4454
Modified: 2024-11-21
CVE-2018-19364
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- [oss-security] 20181120 CVE-2018-19364 Qemu: 9pfs: Use-after-free due to race condition while updating fid path
- [oss-security] 20181120 CVE-2018-19364 Qemu: 9pfs: Use-after-free due to race condition while updating fid path
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- FEDORA-2019-88a98ce795
- FEDORA-2019-88a98ce795
- [qemu-devel] 20181107 [PATCH] 9p: write lock path in v9fs_co_open2()
- [qemu-devel] 20181107 [PATCH] 9p: write lock path in v9fs_co_open2()
- [qemu-devel] 20181115 [PATCH] 9p: take write lock on fid path updates
- [qemu-devel] 20181115 [PATCH] 9p: take write lock on fid path updates
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- USN-3826-1
- USN-3826-1
- DSA-4454
- DSA-4454
Modified: 2024-11-21
CVE-2018-19489
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- [oss-security] 20181126 CVE-2018-19489 QEMU: 9pfs: crash due to race condition in renaming files
- [oss-security] 20181126 CVE-2018-19489 QEMU: 9pfs: crash due to race condition in renaming files
- 106007
- 106007
- qemu-cve201819489-dos(153326)
- qemu-cve201819489-dos(153326)
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d20398694a3b67a388d955b7a945ba4aa90a8a8
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d20398694a3b67a388d955b7a945ba4aa90a8a8
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- [debian-lts-announce] 20190129 [SECURITY] [DLA 1646-1] qemu security update
- FEDORA-2019-88a98ce795
- FEDORA-2019-88a98ce795
- [qemu-devel] 20181122 9p: fix QEMU crash when renaming files
- [qemu-devel] 20181122 9p: fix QEMU crash when renaming files
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- 20190531 [SECURITY] [DSA 4454-1] qemu security update
- https://security-tracker.debian.org/tracker/CVE-2018-19489
- https://security-tracker.debian.org/tracker/CVE-2018-19489
- USN-3923-1
- USN-3923-1
- DSA-4454
- DSA-4454
Modified: 2024-11-21
CVE-2018-19665
The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
- openSUSE-SU-2019:1226
- openSUSE-SU-2019:1226
- [oss-security] 20181129 CVE-2018-19665 Qemu: bt: integer overflow in Bluetooth routines allows memory corruption
- [oss-security] 20181129 CVE-2018-19665 Qemu: bt: integer overflow in Bluetooth routines allows memory corruption
- 106050
- 106050
- [qemu-devel] 20181119 [PATCH v2] bt: use size_t type for length parameters instead of int
- [qemu-devel] 20181119 [PATCH v2] bt: use size_t type for length parameters instead of int
Modified: 2024-11-21
CVE-2018-20123
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
- [oss-security] 20181213 CVE-2018-20123 QEMU: pvrdma: memory leakage in device hotplug
- [oss-security] 20181213 CVE-2018-20123 QEMU: pvrdma: memory leakage in device hotplug
- 106219
- 106219
- FEDORA-2019-0664c7724d
- FEDORA-2019-0664c7724d
- [qemu-devel] 20181212 Re: [PATCH] pvrdma: release device resources in case of an error
- [qemu-devel] 20181212 Re: [PATCH] pvrdma: release device resources in case of an error
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-20124
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
- [oss-security] 20181218 CVE-2018-20124 QEMU: rdma: OOB access when building scatter-gather array
- [oss-security] 20181218 CVE-2018-20124 QEMU: rdma: OOB access when building scatter-gather array
- 106290
- 106290
- [qemu-devel] 20181213 [PATCH v2 1/6] rdma: check num_sge does not exceed MAX_SGE
- [qemu-devel] 20181213 [PATCH v2 1/6] rdma: check num_sge does not exceed MAX_SGE
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-20125
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.
- [oss-security] 20181219 CVE-2018-20125 QEMU: pvrdma: null dereference or excessive memory allocation when creating QP/CQ
- [oss-security] 20181219 CVE-2018-20125 QEMU: pvrdma: null dereference or excessive memory allocation when creating QP/CQ
- 106298
- 106298
- [qemu-devel] 20181213 [PATCH v2 3/6] pvrdma: check number of pages when creating rings
- [qemu-devel] 20181213 [PATCH v2 3/6] pvrdma: check number of pages when creating rings
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-20126
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
- openSUSE-SU-2019:2510
- openSUSE-SU-2019:2510
- openSUSE-SU-2019:2505
- openSUSE-SU-2019:2505
- [oss-security] 20181219 CVE-2018-20126 QEMU: pvrdma: memory leakage when creating cq/qp
- [oss-security] 20181219 CVE-2018-20126 QEMU: pvrdma: memory leakage when creating cq/qp
- 106298
- 106298
- [qemu-devel] 20181213 [PATCH v2 4/6] pvrdma: release ring object in case of an error
- [qemu-devel] 20181213 [PATCH v2 4/6] pvrdma: release ring object in case of an error
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-20191
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
- [oss-security] 20181218 CVE-2018-20191 QEMU: pvrdma: uar_read leads to NULL dereference
- [oss-security] 20181218 CVE-2018-20191 QEMU: pvrdma: uar_read leads to NULL dereference
- 106276
- 106276
- FEDORA-2019-88a98ce795
- FEDORA-2019-88a98ce795
- FEDORA-2019-0664c7724d
- FEDORA-2019-0664c7724d
- [qemu-devel] 20181213 Re: [PATCH v2 2/6] pvrdma: add uar_read routine
- [qemu-devel] 20181213 Re: [PATCH v2 2/6] pvrdma: add uar_read routine
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-20216
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).
- [oss-security] 20181219 CVE-2018-20216 QEMU: pvrdma: infinite loop in pvrdma_qp_send/recv
- [oss-security] 20181219 CVE-2018-20216 QEMU: pvrdma: infinite loop in pvrdma_qp_send/recv
- 106291
- 106291
- [qemu-devel] 20181213 Re: [PATCH v2 6/6] pvrdma: check return value from pvrdma_idx_ring_has_ routines
- [qemu-devel] 20181213 Re: [PATCH v2 6/6] pvrdma: check return value from pvrdma_idx_ring_has_ routines
- USN-3923-1
- USN-3923-1
Modified: 2024-11-21
CVE-2018-5683
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
- [oss-security] 20180115 CVE-2018-5683 Qemu: Out-of-bounds read in vga_draw_text routine
- [oss-security] 20180115 CVE-2018-5683 Qemu: Out-of-bounds read in vga_draw_text routine
- 102518
- 102518
- RHSA-2018:0816
- RHSA-2018:0816
- RHSA-2018:1104
- RHSA-2018:1104
- RHSA-2018:2162
- RHSA-2018:2162
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [Qemu-devel] 20180112 Re: [Qemu-devel] [PATCH v3] vga: check the validation of memory addr when draw text
- [Qemu-devel] 20180112 Re: [Qemu-devel] [PATCH v3] vga: check the validation of memory addr when draw text
- USN-3575-1
- USN-3575-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2018-7550
The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.
- 103181
- 103181
- RHSA-2018:1369
- RHSA-2018:1369
- RHSA-2018:2462
- RHSA-2018:2462
- https://bugzilla.redhat.com/show_bug.cgi?id=1549798
- https://bugzilla.redhat.com/show_bug.cgi?id=1549798
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53
- [debian-lts-announce] 20180417 [SECURITY] [DLA 1350-1] qemu-kvm security update
- [debian-lts-announce] 20180417 [SECURITY] [DLA 1350-1] qemu-kvm security update
- [debian-lts-announce] 20180417 [SECURITY] [DLA 1351-1] qemu security update
- [debian-lts-announce] 20180417 [SECURITY] [DLA 1351-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
- [qemu-devel] 20180228 [PATCH] multiboot: check mh_load_end_addr address field
- [qemu-devel] 20180228 [PATCH] multiboot: check mh_load_end_addr address field
- USN-3649-1
- USN-3649-1
- DSA-4213
- DSA-4213
Modified: 2024-11-21
CVE-2018-7858
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.
- openSUSE-SU-2019:1074
- openSUSE-SU-2019:1074
- [oss-security] 20180309 CVE-2018-7858 Qemu: cirrus: OOB access when updating vga display
- [oss-security] 20180309 CVE-2018-7858 Qemu: cirrus: OOB access when updating vga display
- 103350
- 103350
- RHSA-2018:1369
- RHSA-2018:1369
- RHSA-2018:1416
- RHSA-2018:1416
- RHSA-2018:2162
- RHSA-2018:2162
- https://bugzilla.redhat.com/show_bug.cgi?id=1553402
- https://bugzilla.redhat.com/show_bug.cgi?id=1553402
- [qemu-devel] 20180308 [PATCH] vga: fix region calculation
- [qemu-devel] 20180308 [PATCH] vga: fix region calculation
- USN-3649-1
- USN-3649-1
Modified: 2024-11-21
CVE-2019-11091
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1505
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1806
- openSUSE-SU-2019:1805
- openSUSE-SU-2019:1805
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190712-01-mds-en
- RHSA-2019:1455
- RHSA-2019:1455
- RHSA-2019:2553
- RHSA-2019:2553
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- https://kc.mcafee.com/corporate/index?page=content&id=SB10292
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- [debian-lts-announce] 20190620 [SECURITY] [DLA 1789-2] intel-microcode security update
- FEDORA-2019-1f5832fc0e
- FEDORA-2019-1f5832fc0e
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4447-2] intel-microcode security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20190624 [SECURITY] [DSA 4469-1] libvirt security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20191112 [SECURITY] [DSA 4564-1] linux security update
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- 20200114 [SECURITY] [DSA 4602-1] xen security update
- GLSA-202003-56
- GLSA-202003-56
- USN-3977-3
- USN-3977-3
- DSA-4602
- DSA-4602
- FreeBSD-SA-19:07
- FreeBSD-SA-19:07
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
- https://www.synology.com/security/advisory/Synology_SA_19_24
- https://www.synology.com/security/advisory/Synology_SA_19_24
Modified: 2024-11-21
CVE-2019-12928
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Modified: 2024-11-21
CVE-2019-12929
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Modified: 2024-11-21
CVE-2019-20175
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.
- https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg00597.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg00597.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg02165.html
- https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg02165.html
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg667396.html
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg667396.html
Modified: 2024-11-21
CVE-2019-8934
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- openSUSE-SU-2019:1274
- openSUSE-SU-2019:1405
- http://www.openwall.com/lists/oss-security/2019/02/21/1
- http://www.securityfocus.com/bid/107115
- https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
- https://security.netapp.com/advisory/ntap-20190411-0006/
- openSUSE-SU-2019:1274
- https://security.netapp.com/advisory/ntap-20190411-0006/
- https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
- http://www.securityfocus.com/bid/107115
- http://www.openwall.com/lists/oss-security/2019/02/21/1
- openSUSE-SU-2019:1405
Modified: 2024-11-21
CVE-2020-10717
A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10717
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00141.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00143.html
- GLSA-202011-09
- https://www.openwall.com/lists/oss-security/2020/05/04/1
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10717
- https://www.openwall.com/lists/oss-security/2020/05/04/1
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00143.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00141.html
Modified: 2024-11-21
CVE-2020-10761
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.
- openSUSE-SU-2020:1108
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200731-0001/
- USN-4467-1
- https://www.openwall.com/lists/oss-security/2020/06/09/1
- openSUSE-SU-2020:1108
- https://www.openwall.com/lists/oss-security/2020/06/09/1
- USN-4467-1
- https://security.netapp.com/advisory/ntap-20200731-0001/
- GLSA-202011-09
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761
Modified: 2024-11-21
CVE-2020-12829
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
Modified: 2024-11-21
CVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
- http://www.openwall.com/lists/oss-security/2020/05/27/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1838546
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html
- GLSA-202011-09
- USN-4467-1
- http://www.openwall.com/lists/oss-security/2020/05/27/2
- USN-4467-1
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- https://bugzilla.redhat.com/show_bug.cgi?id=1838546
Modified: 2024-11-21
CVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
- openSUSE-SU-2020:1108
- http://www.openwall.com/lists/oss-security/2020/05/28/1
- [debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200608-0003/
- https://security-tracker.debian.org/tracker/CVE-2020-13361
- USN-4467-1
- DSA-4728
- openSUSE-SU-2020:1108
- DSA-4728
- USN-4467-1
- https://security-tracker.debian.org/tracker/CVE-2020-13361
- https://security.netapp.com/advisory/ntap-20200608-0003/
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- [debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update
- http://www.openwall.com/lists/oss-security/2020/05/28/1
Modified: 2024-11-21
CVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
- openSUSE-SU-2020:1108
- http://www.openwall.com/lists/oss-security/2020/05/28/2
- [debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200608-0003/
- https://security-tracker.debian.org/tracker/CVE-2020-13362
- USN-4467-1
- DSA-4728
- openSUSE-SU-2020:1108
- DSA-4728
- USN-4467-1
- https://security-tracker.debian.org/tracker/CVE-2020-13362
- https://security.netapp.com/advisory/ntap-20200608-0003/
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- [debian-lts-announce] 20200629 [SECURITY] [DLA 2262-1] qemu security update
- http://www.openwall.com/lists/oss-security/2020/05/28/2
Modified: 2024-11-21
CVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- http://www.openwall.com/lists/oss-security/2020/06/01/6
- [oss-security] 20200615 Re: CVE-2020-13754 QEMU: msix: OOB access during mmio operations may lead to DoS
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200608-0007/
- USN-4467-1
- DSA-4728
- http://www.openwall.com/lists/oss-security/2020/06/01/6
- DSA-4728
- USN-4467-1
- https://security.netapp.com/advisory/ntap-20200608-0007/
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html
- [debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
- [oss-security] 20200615 Re: CVE-2020-13754 QEMU: msix: OOB access during mmio operations may lead to DoS
Modified: 2024-11-21
CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200717-0001/
- https://www.openwall.com/lists/oss-security/2020/06/04/1
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html
- https://www.openwall.com/lists/oss-security/2020/06/04/1
- https://security.netapp.com/advisory/ntap-20200717-0001/
- GLSA-202011-09
Modified: 2024-11-21
CVE-2020-13800
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
- openSUSE-SU-2020:1108
- https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200717-0001/
- USN-4467-1
- https://www.openwall.com/lists/oss-security/2020/06/04/2
- openSUSE-SU-2020:1108
- https://www.openwall.com/lists/oss-security/2020/06/04/2
- USN-4467-1
- https://security.netapp.com/advisory/ntap-20200717-0001/
- GLSA-202011-09
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html
- https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800
Modified: 2024-11-21
CVE-2020-14364
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
- openSUSE-SU-2020:1664
- openSUSE-SU-2020:1664
- https://bugzilla.redhat.com/show_bug.cgi?id=1869201
- https://bugzilla.redhat.com/show_bug.cgi?id=1869201
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- FEDORA-2020-3689b67b53
- FEDORA-2020-3689b67b53
- FEDORA-2020-eeb29955ed
- FEDORA-2020-eeb29955ed
- GLSA-202009-14
- GLSA-202009-14
- GLSA-202011-09
- GLSA-202011-09
- https://security.netapp.com/advisory/ntap-20200924-0006/
- https://security.netapp.com/advisory/ntap-20200924-0006/
- USN-4511-1
- USN-4511-1
- DSA-4760
- DSA-4760
- https://www.openwall.com/lists/oss-security/2020/08/24/2
- https://www.openwall.com/lists/oss-security/2020/08/24/2
- https://www.openwall.com/lists/oss-security/2020/08/24/3
- https://www.openwall.com/lists/oss-security/2020/08/24/3
Modified: 2024-11-21
CVE-2020-14394
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1908004
- https://bugzilla.redhat.com/show_bug.cgi?id=1908004
- https://gitlab.com/qemu-project/qemu/-/issues/646
- https://gitlab.com/qemu-project/qemu/-/issues/646
- [debian-lts-announce] 20230314 [SECURITY] [DLA 3362-1] qemu security update
- [debian-lts-announce] 20230314 [SECURITY] [DLA 3362-1] qemu security update
- FEDORA-2022-22b1f8dae2
- FEDORA-2022-22b1f8dae2
Modified: 2024-11-21
CVE-2020-14415
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
Modified: 2024-11-21
CVE-2020-15469
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- http://www.openwall.com/lists/oss-security/2020/07/02/1
- http://www.openwall.com/lists/oss-security/2020/07/02/1
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09961.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09961.html
Modified: 2024-11-21
CVE-2020-15863
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
- openSUSE-SU-2020:1664
- openSUSE-SU-2020:1664
- http://www.openwall.com/lists/oss-security/2020/07/22/1
- http://www.openwall.com/lists/oss-security/2020/07/22/1
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=5519724a13664b43e225ca05351c60b4468e4555
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=5519724a13664b43e225ca05351c60b4468e4555
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg03497.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg03497.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg05745.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg05745.html
- GLSA-202208-27
- GLSA-202208-27
- USN-4467-1
- USN-4467-1
- DSA-4760
- DSA-4760
Modified: 2024-11-21
CVE-2020-16092
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
- openSUSE-SU-2020:1664
- openSUSE-SU-2020:1664
- http://www.openwall.com/lists/oss-security/2020/08/10/1
- http://www.openwall.com/lists/oss-security/2020/08/10/1
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg07563.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg07563.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20200821-0006/
- https://security.netapp.com/advisory/ntap-20200821-0006/
- USN-4467-1
- USN-4467-1
- DSA-4760
- DSA-4760
Modified: 2024-11-21
CVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
- openSUSE-SU-2020:0468
- openSUSE-SU-2020:0468
- RHSA-2020:0669
- RHSA-2020:0669
- RHSA-2020:0730
- RHSA-2020:0730
- RHSA-2020:0731
- RHSA-2020:0731
- RHSA-2020:0773
- RHSA-2020:0773
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711
- [debian-lts-announce] 20200316 [SECURITY] [DLA 2144-1] qemu security update
- [debian-lts-announce] 20200316 [SECURITY] [DLA 2144-1] qemu security update
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html
- https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html
- GLSA-202005-02
- GLSA-202005-02
- USN-4283-1
- USN-4283-1
- https://www.openwall.com/lists/oss-security/2020/01/23/3
- https://www.openwall.com/lists/oss-security/2020/01/23/3
Modified: 2024-11-21
CVE-2020-17380
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
- [oss-security] 20210309 CVE-2021-3409 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
- [oss-security] 20210309 CVE-2021-3409 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
- https://bugzilla.redhat.com/show_bug.cgi?id=1862167
- https://bugzilla.redhat.com/show_bug.cgi?id=1862167
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01175.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01175.html
- https://security.netapp.com/advisory/ntap-20210312-0003/
- https://security.netapp.com/advisory/ntap-20210312-0003/
Modified: 2024-11-21
CVE-2020-24352
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
Modified: 2024-11-21
CVE-2020-25085
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
- http://www.openwall.com/lists/oss-security/2020/09/16/6
- http://www.openwall.com/lists/oss-security/2020/09/16/6
- [oss-security] 20210309 CVE-2021-3409 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
- [oss-security] 20210309 CVE-2021-3409 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
- https://bugs.launchpad.net/qemu/+bug/1892960
- https://bugs.launchpad.net/qemu/+bug/1892960
- [debian-lts-announce] 20201129 [SECURITY] [DLA 2469-1] qemu security update
- [debian-lts-announce] 20201129 [SECURITY] [DLA 2469-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg00733.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg00733.html
- https://security.netapp.com/advisory/ntap-20201009-0005/
- https://security.netapp.com/advisory/ntap-20201009-0005/
Modified: 2024-11-21
CVE-2020-25723
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
- [oss-security] 20201222 CVE-2020-25723 QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
- [oss-security] 20201222 CVE-2020-25723 QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
- https://bugzilla.redhat.com/show_bug.cgi?id=1898579
- https://bugzilla.redhat.com/show_bug.cgi?id=1898579
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20201218-0004/
- https://security.netapp.com/advisory/ntap-20201218-0004/
Modified: 2024-11-21
CVE-2020-25742
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
- http://www.openwall.com/lists/oss-security/2020/09/29/1
- http://www.openwall.com/lists/oss-security/2020/09/29/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1883178
- https://bugzilla.redhat.com/show_bug.cgi?id=1883178
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
- https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
- https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
Modified: 2024-11-21
CVE-2020-25743
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
- http://www.openwall.com/lists/oss-security/2020/09/29/1
- http://www.openwall.com/lists/oss-security/2020/09/29/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1881409
- https://bugzilla.redhat.com/show_bug.cgi?id=1881409
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05967.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05967.html
- https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1b
- https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1b
Modified: 2024-11-21
CVE-2020-27661
A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1890653
- https://bugzilla.redhat.com/show_bug.cgi?id=1890653
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bea2a9e3e00b275dc40cfa09c760c715b8753e03
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bea2a9e3e00b275dc40cfa09c760c715b8753e03
- https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg04263.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg04263.html
- https://security.netapp.com/advisory/ntap-20210720-0010/
- https://security.netapp.com/advisory/ntap-20210720-0010/
- https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1770368.html
- https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1770368.html
Modified: 2024-11-21
CVE-2020-27821
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
- [oss-security] 20201216 CVE-2020-27821 QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c
- [oss-security] 20201216 CVE-2020-27821 QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c
- https://bugzilla.redhat.com/show_bug.cgi?id=1902651
- https://bugzilla.redhat.com/show_bug.cgi?id=1902651
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210115-0006/
- https://security.netapp.com/advisory/ntap-20210115-0006/
Modified: 2024-11-21
CVE-2020-29443
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
- http://www.openwall.com/lists/oss-security/2021/01/18/2
- http://www.openwall.com/lists/oss-security/2021/01/18/2
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html
- https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html
- https://security.netapp.com/advisory/ntap-20210304-0003/
- https://security.netapp.com/advisory/ntap-20210304-0003/
Modified: 2024-11-21
CVE-2020-35503
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Modified: 2024-11-21
CVE-2020-35504
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- [oss-security] 20210416 QEMU: ESP security fixes
- [oss-security] 20210416 QEMU: ESP security fixes
- https://bugzilla.redhat.com/show_bug.cgi?id=1909766
- https://bugzilla.redhat.com/show_bug.cgi?id=1909766
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://www.openwall.com/lists/oss-security/2021/04/16/3
- https://www.openwall.com/lists/oss-security/2021/04/16/3
Modified: 2024-11-21
CVE-2020-35505
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- [oss-security] 20210416 QEMU: ESP security fixes
- [oss-security] 20210416 QEMU: ESP security fixes
- https://bugzilla.redhat.com/show_bug.cgi?id=1909769
- https://bugzilla.redhat.com/show_bug.cgi?id=1909769
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://www.openwall.com/lists/oss-security/2021/04/16/3
- https://www.openwall.com/lists/oss-security/2021/04/16/3
Modified: 2024-11-21
CVE-2020-35506
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- [oss-security] 20210416 QEMU: ESP security fixes
- [oss-security] 20210416 QEMU: ESP security fixes
- https://bugzilla.redhat.com/show_bug.cgi?id=1909996
- https://bugzilla.redhat.com/show_bug.cgi?id=1909996
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://www.openwall.com/lists/oss-security/2021/04/16/3
- https://www.openwall.com/lists/oss-security/2021/04/16/3
Modified: 2024-11-21
CVE-2020-35517
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.
- https://bugzilla.redhat.com/show_bug.cgi?id=1915823
- https://bugzilla.redhat.com/show_bug.cgi?id=1915823
- https://github.com/qemu/qemu/commit/ebf101955ce8f8d72fba103b5151115a4335de2c
- https://github.com/qemu/qemu/commit/ebf101955ce8f8d72fba103b5151115a4335de2c
- https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
- https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210312-0002/
- https://security.netapp.com/advisory/ntap-20210312-0002/
- https://www.openwall.com/lists/oss-security/2021/01/22/1
- https://www.openwall.com/lists/oss-security/2021/01/22/1
Modified: 2024-11-21
CVE-2021-20181
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1927007
- https://bugzilla.redhat.com/show_bug.cgi?id=1927007
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210720-0009/
- https://security.netapp.com/advisory/ntap-20210720-0009/
- https://www.zerodayinitiative.com/advisories/ZDI-21-159/
- https://www.zerodayinitiative.com/advisories/ZDI-21-159/
Modified: 2024-11-21
CVE-2021-20196
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- https://bugs.launchpad.net/qemu/+bug/1912780
- https://bugs.launchpad.net/qemu/+bug/1912780
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210708-0004/
- https://security.netapp.com/advisory/ntap-20210708-0004/
- https://www.openwall.com/lists/oss-security/2021/01/28/1
- https://www.openwall.com/lists/oss-security/2021/01/28/1
Modified: 2024-11-21
CVE-2021-20203
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
- https://bugs.launchpad.net/qemu/+bug/1913873
- https://bugs.launchpad.net/qemu/+bug/1913873
- https://bugzilla.redhat.com/show_bug.cgi?id=1922441
- https://bugzilla.redhat.com/show_bug.cgi?id=1922441
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
Modified: 2024-11-21
CVE-2021-20221
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
- [oss-security] 20210205 CVE-2021-20221 QEMU: aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field
- [oss-security] 20210205 CVE-2021-20221 QEMU: aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field
- https://bugzilla.redhat.com/show_bug.cgi?id=1924601
- https://bugzilla.redhat.com/show_bug.cgi?id=1924601
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20210218 [SECURITY] [DLA 2560-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210708-0005/
- https://security.netapp.com/advisory/ntap-20210708-0005/
Modified: 2024-11-21
CVE-2021-20257
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1930087
- https://bugzilla.redhat.com/show_bug.cgi?id=1930087
- https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8
- https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html
- https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220425-0003/
- https://security.netapp.com/advisory/ntap-20220425-0003/
- https://www.openwall.com/lists/oss-security/2021/02/25/2
- https://www.openwall.com/lists/oss-security/2021/02/25/2
Modified: 2024-11-21
CVE-2021-20263
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
- https://bugzilla.redhat.com/show_bug.cgi?id=1933668
- https://bugzilla.redhat.com/show_bug.cgi?id=1933668
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210507-0002/
- https://security.netapp.com/advisory/ntap-20210507-0002/
- https://www.openwall.com/lists/oss-security/2021/03/08/1
- https://www.openwall.com/lists/oss-security/2021/03/08/1
Modified: 2024-11-21
CVE-2021-20295
It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756, refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.
- https://access.redhat.com/security/cve/CVE-2020-10756
- https://access.redhat.com/security/cve/CVE-2020-10756
- https://bugzilla.redhat.com/show_bug.cgi?id=1944075
- https://bugzilla.redhat.com/show_bug.cgi?id=1944075
- https://security.netapp.com/advisory/ntap-20220519-0003/
- https://security.netapp.com/advisory/ntap-20220519-0003/
Modified: 2024-11-21
CVE-2021-3392
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
- https://bugs.launchpad.net/qemu/+bug/1914236
- https://bugs.launchpad.net/qemu/+bug/1914236
- https://bugzilla.redhat.com/show_bug.cgi?id=1924042
- https://bugzilla.redhat.com/show_bug.cgi?id=1924042
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210507-0001/
- https://security.netapp.com/advisory/ntap-20210507-0001/
Modified: 2024-11-21
CVE-2021-3409
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
- https://bugzilla.redhat.com/show_bug.cgi?id=1928146
- https://bugzilla.redhat.com/show_bug.cgi?id=1928146
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210507-0001/
- https://security.netapp.com/advisory/ntap-20210507-0001/
- https://www.openwall.com/lists/oss-security/2021/03/09/1
- https://www.openwall.com/lists/oss-security/2021/03/09/1
Modified: 2024-11-21
CVE-2021-3416
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
- https://bugzilla.redhat.com/show_bug.cgi?id=1932827
- https://bugzilla.redhat.com/show_bug.cgi?id=1932827
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210507-0002/
- https://security.netapp.com/advisory/ntap-20210507-0002/
- https://www.openwall.com/lists/oss-security/2021/02/26/1
- https://www.openwall.com/lists/oss-security/2021/02/26/1
Modified: 2024-11-21
CVE-2021-3507
A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.
- https://bugzilla.redhat.com/show_bug.cgi?id=1951118
- https://bugzilla.redhat.com/show_bug.cgi?id=1951118
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://security.netapp.com/advisory/ntap-20210528-0005/
- https://security.netapp.com/advisory/ntap-20210528-0005/
Modified: 2024-11-21
CVE-2021-3527
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1955695
- https://bugzilla.redhat.com/show_bug.cgi?id=1955695
- https://gitlab.com/qemu-project/qemu/-/commit/05a40b172e4d691371534828078be47e7fff524c
- https://gitlab.com/qemu-project/qemu/-/commit/05a40b172e4d691371534828078be47e7fff524c
- https://gitlab.com/qemu-project/qemu/-/commit/7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986
- https://gitlab.com/qemu-project/qemu/-/commit/7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210708-0008/
- https://security.netapp.com/advisory/ntap-20210708-0008/
- https://www.openwall.com/lists/oss-security/2021/05/05/5
- https://www.openwall.com/lists/oss-security/2021/05/05/5
Modified: 2024-11-21
CVE-2021-3544
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- https://bugzilla.redhat.com/show_bug.cgi?id=1958935
- https://bugzilla.redhat.com/show_bug.cgi?id=1958935
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://security.netapp.com/advisory/ntap-20210720-0008/
- DSA-4980
- DSA-4980
Modified: 2024-11-21
CVE-2021-3545
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- https://bugzilla.redhat.com/show_bug.cgi?id=1958955
- https://bugzilla.redhat.com/show_bug.cgi?id=1958955
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://security.netapp.com/advisory/ntap-20210720-0008/
- DSA-4980
- DSA-4980
Modified: 2024-11-21
CVE-2021-3546
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process.
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- [oss-security] 20210531 QEMU: security issues in vhost-user-gpu
- https://bugzilla.redhat.com/show_bug.cgi?id=1958978
- https://bugzilla.redhat.com/show_bug.cgi?id=1958978
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210720-0008/
- https://security.netapp.com/advisory/ntap-20210720-0008/
- DSA-4980
- DSA-4980
Modified: 2024-11-21
CVE-2021-3582
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1966266
- https://bugzilla.redhat.com/show_bug.cgi?id=1966266
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220429-0003/
- https://security.netapp.com/advisory/ntap-20220429-0003/
Modified: 2024-11-21
CVE-2021-3607
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1973349
- https://bugzilla.redhat.com/show_bug.cgi?id=1973349
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07925.html
- https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07925.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220318-0002/
- https://security.netapp.com/advisory/ntap-20220318-0002/
Modified: 2024-11-21
CVE-2021-3608
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1973383
- https://bugzilla.redhat.com/show_bug.cgi?id=1973383
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html
- https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220318-0002/
- https://security.netapp.com/advisory/ntap-20220318-0002/
Modified: 2024-11-21
CVE-2021-3611
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
- https://bugzilla.redhat.com/show_bug.cgi?id=1973784
- https://bugzilla.redhat.com/show_bug.cgi?id=1973784
- https://gitlab.com/qemu-project/qemu/-/issues/542
- https://gitlab.com/qemu-project/qemu/-/issues/542
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220624-0001/
- https://security.netapp.com/advisory/ntap-20220624-0001/
Modified: 2024-11-21
CVE-2021-3638
An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1979858
- https://bugzilla.redhat.com/show_bug.cgi?id=1979858
- FEDORA-2023-c8a60f6f80
- FEDORA-2023-c8a60f6f80
- FEDORA-2022-22b1f8dae2
- FEDORA-2022-22b1f8dae2
- https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html
- https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html
- https://security.netapp.com/advisory/ntap-20220407-0003/
- https://security.netapp.com/advisory/ntap-20220407-0003/
- https://ubuntu.com/security/CVE-2021-3638
- https://ubuntu.com/security/CVE-2021-3638
Modified: 2024-11-21
CVE-2021-3682
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
- https://bugzilla.redhat.com/show_bug.cgi?id=1989651
- https://bugzilla.redhat.com/show_bug.cgi?id=1989651
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210902-0006/
- https://security.netapp.com/advisory/ntap-20210902-0006/
- DSA-4980
- DSA-4980
Modified: 2024-11-21
CVE-2021-3713
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
- https://bugzilla.redhat.com/show_bug.cgi?id=1994640
- https://bugzilla.redhat.com/show_bug.cgi?id=1994640
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20210923-0006/
- https://security.netapp.com/advisory/ntap-20210923-0006/
- DSA-4980
- DSA-4980
Modified: 2024-11-21
CVE-2021-3748
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
- https://bugzilla.redhat.com/show_bug.cgi?id=1998514
- https://bugzilla.redhat.com/show_bug.cgi?id=1998514
- https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6
- https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html
- https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220425-0004/
- https://security.netapp.com/advisory/ntap-20220425-0004/
- https://ubuntu.com/security/CVE-2021-3748
- https://ubuntu.com/security/CVE-2021-3748
Modified: 2024-11-21
CVE-2021-3750
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
- https://bugzilla.redhat.com/show_bug.cgi?id=1999073
- https://bugzilla.redhat.com/show_bug.cgi?id=1999073
- https://gitlab.com/qemu-project/qemu/-/issues/541
- https://gitlab.com/qemu-project/qemu/-/issues/541
- https://gitlab.com/qemu-project/qemu/-/issues/556
- https://gitlab.com/qemu-project/qemu/-/issues/556
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220624-0003/
- https://security.netapp.com/advisory/ntap-20220624-0003/
Modified: 2024-11-21
CVE-2021-3929
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
- https://access.redhat.com/security/cve/CVE-2021-3929
- https://access.redhat.com/security/cve/CVE-2021-3929
- https://bugzilla.redhat.com/show_bug.cgi?id=2020298
- https://bugzilla.redhat.com/show_bug.cgi?id=2020298
- https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385
- https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385
- https://gitlab.com/qemu-project/qemu/-/issues/556
- https://gitlab.com/qemu-project/qemu/-/issues/556
- https://gitlab.com/qemu-project/qemu/-/issues/782
- https://gitlab.com/qemu-project/qemu/-/issues/782
- FEDORA-2022-f0a2695054
- FEDORA-2022-f0a2695054
Modified: 2024-11-21
CVE-2021-3930
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
- https://bugzilla.redhat.com/show_bug.cgi?id=2020588
- https://bugzilla.redhat.com/show_bug.cgi?id=2020588
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220225-0007/
- https://security.netapp.com/advisory/ntap-20220225-0007/
Modified: 2024-11-21
CVE-2021-3947
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
Modified: 2024-11-21
CVE-2021-4158
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
- https://access.redhat.com/security/cve/CVE-2021-4158
- https://access.redhat.com/security/cve/CVE-2021-4158
- https://bugzilla.redhat.com/show_bug.cgi?id=2035002
- https://bugzilla.redhat.com/show_bug.cgi?id=2035002
- https://gitlab.com/qemu-project/qemu/-/commit/9bd6565ccee68f72d5012e24646e12a1c662827e
- https://gitlab.com/qemu-project/qemu/-/commit/9bd6565ccee68f72d5012e24646e12a1c662827e
- https://gitlab.com/qemu-project/qemu/-/issues/770
- https://gitlab.com/qemu-project/qemu/-/issues/770
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg857944.html
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg857944.html
Modified: 2024-11-21
CVE-2021-4206
A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
- https://bugzilla.redhat.com/show_bug.cgi?id=2036998
- https://bugzilla.redhat.com/show_bug.cgi?id=2036998
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://starlabs.sg/advisories/21-4206/
- https://starlabs.sg/advisories/21-4206/
- DSA-5133
- DSA-5133
Modified: 2024-11-21
CVE-2021-4207
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
- https://bugzilla.redhat.com/show_bug.cgi?id=2036966
- https://bugzilla.redhat.com/show_bug.cgi?id=2036966
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://starlabs.sg/advisories/21-4207/
- https://starlabs.sg/advisories/21-4207/
- DSA-5133
- DSA-5133
Modified: 2024-11-21
CVE-2022-0216
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
- https://access.redhat.com/security/cve/CVE-2022-0216
- https://access.redhat.com/security/cve/CVE-2022-0216
- https://bugzilla.redhat.com/show_bug.cgi?id=2036953
- https://bugzilla.redhat.com/show_bug.cgi?id=2036953
- https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4
- https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4
- https://gitlab.com/qemu-project/qemu/-/issues/972
- https://gitlab.com/qemu-project/qemu/-/issues/972
- FEDORA-2022-4387579e67
- FEDORA-2022-4387579e67
- https://starlabs.sg/advisories/22/22-0216/
- https://starlabs.sg/advisories/22/22-0216/
Modified: 2024-11-21
CVE-2022-0358
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
- https://access.redhat.com/security/cve/CVE-2022-0358
- https://access.redhat.com/security/cve/CVE-2022-0358
- https://bugzilla.redhat.com/show_bug.cgi?id=2044863
- https://bugzilla.redhat.com/show_bug.cgi?id=2044863
- https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca
- https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca
- https://security.netapp.com/advisory/ntap-20221007-0008/
- https://security.netapp.com/advisory/ntap-20221007-0008/
Modified: 2024-11-21
CVE-2022-1050
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.
Modified: 2024-11-21
CVE-2022-26353
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.
- https://gitlab.com/qemu-project/qemu/-/commit/abe300d9d894f7138e1af7c8e9c88c04bfe98b37
- https://gitlab.com/qemu-project/qemu/-/commit/abe300d9d894f7138e1af7c8e9c88c04bfe98b37
- https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg02438.html
- https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg02438.html
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220425-0003/
- https://security.netapp.com/advisory/ntap-20220425-0003/
- DSA-5133
- DSA-5133
Modified: 2024-11-21
CVE-2022-26354
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
- https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf
- https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
- GLSA-202208-27
- GLSA-202208-27
- https://security.netapp.com/advisory/ntap-20220425-0003/
- https://security.netapp.com/advisory/ntap-20220425-0003/
- DSA-5133
- DSA-5133
Modified: 2024-11-21
CVE-2022-3165
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
- https://gitlab.com/qemu-project/qemu/-/commit/d307040b18
- https://gitlab.com/qemu-project/qemu/-/commit/d307040b18
- FEDORA-2022-8dcdfe7297
- FEDORA-2022-8dcdfe7297
- FEDORA-2022-4387579e67
- FEDORA-2022-4387579e67
- https://security.netapp.com/advisory/ntap-20221223-0006/
- https://security.netapp.com/advisory/ntap-20221223-0006/
Modified: 2024-11-21
CVE-2022-36648
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.
Modified: 2024-11-21
CVE-2022-3872
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Modified: 2024-11-21
CVE-2022-4144
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.
- https://bugzilla.redhat.com/show_bug.cgi?id=2148506
- https://bugzilla.redhat.com/show_bug.cgi?id=2148506
- FEDORA-2023-c8a60f6f80
- FEDORA-2023-c8a60f6f80
- FEDORA-2022-22b1f8dae2
- FEDORA-2022-22b1f8dae2
- https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html
- https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html
- https://security.netapp.com/advisory/ntap-20230127-0012/
- https://security.netapp.com/advisory/ntap-20230127-0012/
Closed bugs
Не работает guest-fsfreeze-freeze
Неверные имена эмуляторов в конфигурационных файлах
make-initrd does not include necessary libraries when building image for m-p's VM aarch64 target
Дублируются magic для разных интерпретаторов
qemu-user-static* зависят от qemu-aux
Проблема при создании виртуальной машины в Opennebula
Package libdnf updated to version 0.65.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-04884
Уязвимость библиотеки менеджера пакета libdnf, связанная с некорректным подтверждением криптографической подписи данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-3445
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
Package evms updated to version 2.5.5-alt75 for branch sisyphus_e2k.
Closed bugs
После создания raid1 на nvme разделе остается device-mapper устройство раздела
Package curl updated to version 8.6.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2024-01014
Уязвимость реализации протокола TLS утилиты командной строки cURL, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации
Modified: 2024-11-21
CVE-2024-0853
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- www
- www
- json
- json
- issue
- issue
- https://security.netapp.com/advisory/ntap-20240307-0004/
- https://security.netapp.com/advisory/ntap-20240307-0004/
- https://security.netapp.com/advisory/ntap-20240426-0009/
- https://security.netapp.com/advisory/ntap-20240426-0009/
- https://security.netapp.com/advisory/ntap-20240503-0012/
- https://security.netapp.com/advisory/ntap-20240503-0012/
Package dblatex updated to version 0.3.12-alt3 for branch sisyphus_e2k.
Closed bugs
Ошибка упаковки пакета