LOW1.5
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 1.5
CVSS:2.0/AV:L/AC:M/Au:S/C:N/I:N/A:PСсылки
Серьёзность:
Закрытые проблемы (159)
LOW1.5
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 1.5
CVSS:2.0/AV:L/AC:M/Au:S/C:N/I:N/A:PСсылки
LOW1.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю читать память хоста
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NСсылки
LOW1.5
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 1.5
CVSS:2.0/AV:L/AC:M/Au:S/C:N/I:N/A:PСсылки
MEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю нарушить конфиденциальность, целостность и доступность
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю нарушить конфиденциальность, целостность и доступность данных
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю нарушить конфиденциальность, целостность и доступность данных
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать аварийное завершение работы приложения
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PMEDIUM4.9
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CMEDIUM5.0
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PLOW2.1
Уязвимость эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PHIGH7.2
Уязвимость компонента hw/virtio/virtio-crypto.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CHIGH7.8
Уязвимость компонента audio.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CMEDIUM5.0
Уязвимость в qemu-nbd эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PHIGH8.8
Уязвимость функции load_multiboot (hw/i386/multiboot.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю выполнить произвольный код
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CСсылки
MEDIUM5.3
Уязвимость функции v9fs_xattrwalk (hw/9pfs/9p.c) эмулятора аппаратного обеспечения Qemu, позволяющая нарушителю получить конфиденциальную информацию из памяти хостовой операционной системы
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS 2.0НИЗКАЯ 3.5
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:N/A:NСсылки
MEDIUM5.0
Уязвимость сервера Qemu-NBD эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PСсылки
HIGH8.6
Уязвимость сервера Network Block Device (NBD) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xВЫСОКАЯ 8.6
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HCVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CСсылки
HIGH7.5
Уязвимость компонента io/channel-websock.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CСсылки
MEDIUM6.0
Уязвимость функции mode4and5 (hw/display/cirrus_vga.c) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HCVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:CСсылки
MEDIUM6.5
Уязвимость компонента Virtio Vring эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HCVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:CСсылки
MEDIUM5.5
Уязвимость компонента ROUND_UP (n, d) эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:CСсылки
LOW3.7
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xНИЗКАЯ 3.7
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PСсылки
MEDIUM5.5
Уязвимость функции virgl_cmd_get_capset компонента hw/display/virtio-gpu-3d.c эмулятора аппаратного обеспечения QEMU, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PСсылки
MEDIUM5.5
Уязвимость функции virtio_gpu_set_scanout компонента hw/display/virtio-gpu.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком механизма освобождения памяти перед удалением последней ссылки, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CСсылки
HIGH7.0
Уязвимость функции disas_insn компонента target/i386/translate.c эмулятора аппаратного обеспечения QEMU, связанная с недостатком механизма управления генерацией кода, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
CVSS 3.xВЫСОКАЯ 7.0
CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CСсылки
MEDIUM5.5
The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
- http://www.openwall.com/lists/oss-security/2016/12/20/1
- http://www.openwall.com/lists/oss-security/2016/12/22/14
- http://www.securityfocus.com/bid/94981
- http://www.securitytracker.com/id/1037525
- https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.html
- https://security.gentoo.org/glsa/201701-49
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
- http://www.openwall.com/lists/oss-security/2016/12/20/1
- http://www.openwall.com/lists/oss-security/2016/12/22/14
- http://www.securityfocus.com/bid/94981
- http://www.securitytracker.com/id/1037525
- https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM5.5
The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7
- http://www.openwall.com/lists/oss-security/2016/12/20/2
- http://www.openwall.com/lists/oss-security/2016/12/22/15
- http://www.securityfocus.com/bid/94978
- http://www.securitytracker.com/id/1037526
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7
- http://www.openwall.com/lists/oss-security/2016/12/20/2
- http://www.openwall.com/lists/oss-security/2016/12/22/15
- http://www.securityfocus.com/bid/94978
- http://www.securitytracker.com/id/1037526
MEDIUM6.0
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e
- http://www.openwall.com/lists/oss-security/2017/01/20/14
- http://www.openwall.com/lists/oss-security/2017/01/21/4
- http://www.securityfocus.com/bid/95770
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e
- http://www.openwall.com/lists/oss-security/2017/01/20/14
- http://www.openwall.com/lists/oss-security/2017/01/21/4
- http://www.securityfocus.com/bid/95770
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
CRITICAL9.8
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
- http://www.openwall.com/lists/oss-security/2016/04/11/6
- http://www.openwall.com/lists/oss-security/2016/04/12/7
- http://www.securityfocus.com/bid/85992
- http://www.ubuntu.com/usn/USN-2974-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1326082
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01131.html
- https://security.gentoo.org/glsa/201609-01
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
- http://www.openwall.com/lists/oss-security/2016/04/11/6
- http://www.openwall.com/lists/oss-security/2016/04/12/7
- http://www.securityfocus.com/bid/85992
- http://www.ubuntu.com/usn/USN-2974-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1326082
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01131.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.5
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
- http://www.securityfocus.com/bid/86067
- http://www.ubuntu.com/usn/USN-2974-1
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1313686
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
- http://www.securityfocus.com/bid/86067
- http://www.ubuntu.com/usn/USN-2974-1
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1313686
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.0
QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/05/23/1
- http://www.openwall.com/lists/oss-security/2016/05/23/4
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1334384
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03774.html
- http://www.openwall.com/lists/oss-security/2016/05/23/1
- http://www.openwall.com/lists/oss-security/2016/05/23/4
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1334384
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03774.html
MEDIUM6.0
The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=06630554ccbdd25780aa03c3548aaff1eb56dffd
- http://www.openwall.com/lists/oss-security/2016/05/24/4
- http://www.openwall.com/lists/oss-security/2016/05/24/7
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04027.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=06630554ccbdd25780aa03c3548aaff1eb56dffd
- http://www.openwall.com/lists/oss-security/2016/05/24/4
- http://www.openwall.com/lists/oss-security/2016/05/24/7
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04027.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NСсылки
- http://www.openwall.com/lists/oss-security/2016/05/25/5
- http://www.openwall.com/lists/oss-security/2016/05/26/7
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1339583
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html
- http://www.openwall.com/lists/oss-security/2016/05/25/5
- http://www.openwall.com/lists/oss-security/2016/05/26/7
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1339583
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html
MEDIUM6.0
The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/05/25/6
- http://www.openwall.com/lists/oss-security/2016/05/26/8
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1339578
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04340.html
- https://security.gentoo.org/glsa/201609-01
- http://www.openwall.com/lists/oss-security/2016/05/25/6
- http://www.openwall.com/lists/oss-security/2016/05/26/8
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1339578
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04340.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.0
The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/05/25/7
- http://www.openwall.com/lists/oss-security/2016/05/26/9
- http://www.securityfocus.com/bid/90874
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1336461
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04424.html
- https://security.gentoo.org/glsa/201609-01
- http://www.openwall.com/lists/oss-security/2016/05/25/7
- http://www.openwall.com/lists/oss-security/2016/05/26/9
- http://www.securityfocus.com/bid/90874
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1336461
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04424.html
- https://security.gentoo.org/glsa/201609-01
HIGH7.8
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
CVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a6b3167fa0e825aebb5a7cd8b437b6d41584a196
- http://rhn.redhat.com/errata/RHSA-2016-1606.html
- http://rhn.redhat.com/errata/RHSA-2016-1607.html
- http://rhn.redhat.com/errata/RHSA-2016-1653.html
- http://rhn.redhat.com/errata/RHSA-2016-1654.html
- http://rhn.redhat.com/errata/RHSA-2016-1655.html
- http://rhn.redhat.com/errata/RHSA-2016-1756.html
- http://rhn.redhat.com/errata/RHSA-2016-1763.html
- http://www.openwall.com/lists/oss-security/2016/05/30/6
- http://www.openwall.com/lists/oss-security/2016/05/30/7
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/90948
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1340924
- https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
- https://lists.gnu.org/archive/html/qemu-block/2016-05/msg00779.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a6b3167fa0e825aebb5a7cd8b437b6d41584a196
- http://rhn.redhat.com/errata/RHSA-2016-1606.html
- http://rhn.redhat.com/errata/RHSA-2016-1607.html
- http://rhn.redhat.com/errata/RHSA-2016-1653.html
- http://rhn.redhat.com/errata/RHSA-2016-1654.html
- http://rhn.redhat.com/errata/RHSA-2016-1655.html
- http://rhn.redhat.com/errata/RHSA-2016-1756.html
- http://rhn.redhat.com/errata/RHSA-2016-1763.html
- http://www.openwall.com/lists/oss-security/2016/05/30/6
- http://www.openwall.com/lists/oss-security/2016/05/30/7
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/90948
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1340924
- https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
- https://lists.gnu.org/archive/html/qemu-block/2016-05/msg00779.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/06/02/2
- http://www.openwall.com/lists/oss-security/2016/06/02/9
- http://www.securityfocus.com/bid/90995
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1341931
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05691.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg00150.html
- https://security.gentoo.org/glsa/201609-01
- http://www.openwall.com/lists/oss-security/2016/06/02/2
- http://www.openwall.com/lists/oss-security/2016/06/02/9
- http://www.securityfocus.com/bid/90995
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://bugzilla.redhat.com/show_bug.cgi?id=1341931
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05691.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg00150.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM5.5
The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=844864fbae66935951529408831c2f22367a57b6
- http://www.openwall.com/lists/oss-security/2016/06/08/13
- http://www.openwall.com/lists/oss-security/2016/06/08/3
- http://www.securityfocus.com/bid/91097
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01969.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=844864fbae66935951529408831c2f22367a57b6
- http://www.openwall.com/lists/oss-security/2016/06/08/13
- http://www.openwall.com/lists/oss-security/2016/06/08/3
- http://www.securityfocus.com/bid/91097
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01969.html
- https://security.gentoo.org/glsa/201609-01
HIGH7.8
The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.
CVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff589551c8e8e9e95e211b9d8daafb4ed39f1aec
- http://www.openwall.com/lists/oss-security/2016/06/07/3
- http://www.openwall.com/lists/oss-security/2016/06/08/14
- http://www.securityfocus.com/bid/91079
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01507.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff589551c8e8e9e95e211b9d8daafb4ed39f1aec
- http://www.openwall.com/lists/oss-security/2016/06/07/3
- http://www.openwall.com/lists/oss-security/2016/06/08/14
- http://www.securityfocus.com/bid/91079
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01507.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.7
The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xСРЕДНЯЯ 6.7
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7cad6fd11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75db069e3
- http://www.openwall.com/lists/oss-security/2016/07/25/14
- http://www.openwall.com/lists/oss-security/2016/07/26/7
- http://www.securityfocus.com/bid/92119
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7cad6fd11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75db069e3
- http://www.openwall.com/lists/oss-security/2016/07/25/14
- http://www.openwall.com/lists/oss-security/2016/07/26/7
- http://www.securityfocus.com/bid/92119
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
MEDIUM4.4
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1e7aed70144b4673fc26e73062064b6724795e5f
- http://www.openwall.com/lists/oss-security/2016/07/28/4
- http://www.openwall.com/lists/oss-security/2016/07/28/9
- https://lists.gnu.org/archive/html/qemu-devel/2016-07/msg06246.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1e7aed70144b4673fc26e73062064b6724795e5f
- http://www.openwall.com/lists/oss-security/2016/07/28/4
- http://www.openwall.com/lists/oss-security/2016/07/28/9
- https://lists.gnu.org/archive/html/qemu-devel/2016-07/msg06246.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8
- http://www.openwall.com/lists/oss-security/2016/08/12/1
- http://www.openwall.com/lists/oss-security/2016/08/18/3
- http://www.securityfocus.com/bid/93255
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01602.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8
- http://www.openwall.com/lists/oss-security/2016/08/12/1
- http://www.openwall.com/lists/oss-security/2016/08/18/3
- http://www.securityfocus.com/bid/93255
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01602.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05
- http://www.openwall.com/lists/oss-security/2016/08/11/8
- http://www.openwall.com/lists/oss-security/2016/08/18/7
- http://www.securityfocus.com/bid/92446
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01601.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05
- http://www.openwall.com/lists/oss-security/2016/08/11/8
- http://www.openwall.com/lists/oss-security/2016/08/18/7
- http://www.securityfocus.com/bid/92446
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01601.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.0
The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdda170e50b8af062cf5741e12c4fb5e57a2eacf
- http://www.openwall.com/lists/oss-security/2016/08/11/5
- http://www.openwall.com/lists/oss-security/2016/08/18/5
- http://www.securityfocus.com/bid/92444
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg02108.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdda170e50b8af062cf5741e12c4fb5e57a2eacf
- http://www.openwall.com/lists/oss-security/2016/08/11/5
- http://www.openwall.com/lists/oss-security/2016/08/18/5
- http://www.securityfocus.com/bid/92444
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg02108.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=47882fa4975bf0b58dd74474329fdd7154e8f04c
- http://www.openwall.com/lists/oss-security/2016/08/19/10
- http://www.openwall.com/lists/oss-security/2016/08/19/6
- http://www.securityfocus.com/bid/92556
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03176.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=47882fa4975bf0b58dd74474329fdd7154e8f04c
- http://www.openwall.com/lists/oss-security/2016/08/19/10
- http://www.openwall.com/lists/oss-security/2016/08/19/6
- http://www.securityfocus.com/bid/92556
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03176.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.0
Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=56f101ecce0eafd09e2daf1c4eeb1377d6959261
- http://www.openwall.com/lists/oss-security/2016/08/30/1
- http://www.openwall.com/lists/oss-security/2016/08/30/3
- http://www.securityfocus.com/bid/92680
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03917.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04231.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=56f101ecce0eafd09e2daf1c4eeb1377d6959261
- http://www.openwall.com/lists/oss-security/2016/08/30/1
- http://www.openwall.com/lists/oss-security/2016/08/30/3
- http://www.securityfocus.com/bid/92680
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03917.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04231.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7f61f4690dd153be98900a2a508b88989e692753
- http://www.openwall.com/lists/oss-security/2016/09/06/2
- http://www.openwall.com/lists/oss-security/2016/09/07/1
- http://www.securityfocus.com/bid/92772
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00050.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7f61f4690dd153be98900a2a508b88989e692753
- http://www.openwall.com/lists/oss-security/2016/09/06/2
- http://www.openwall.com/lists/oss-security/2016/09/07/1
- http://www.securityfocus.com/bid/92772
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00050.html
MEDIUM4.4
The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8
- http://www.openwall.com/lists/oss-security/2016/09/06/3
- http://www.openwall.com/lists/oss-security/2016/09/07/2
- http://www.securityfocus.com/bid/92774
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00772.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01246.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8
- http://www.openwall.com/lists/oss-security/2016/09/06/3
- http://www.openwall.com/lists/oss-security/2016/09/07/2
- http://www.securityfocus.com/bid/92774
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00772.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01246.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=65a8e1f6413a0f6f79894da710b5d6d43361d27d
- http://www.openwall.com/lists/oss-security/2016/09/06/4
- http://www.openwall.com/lists/oss-security/2016/09/07/3
- http://www.securityfocus.com/bid/92775
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04295.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04296.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=65a8e1f6413a0f6f79894da710b5d6d43361d27d
- http://www.openwall.com/lists/oss-security/2016/09/06/4
- http://www.openwall.com/lists/oss-security/2016/09/07/3
- http://www.securityfocus.com/bid/92775
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04295.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04296.html
- https://security.gentoo.org/glsa/201609-01
CRITICAL9.8
Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a0d1cbdacff5df4ded16b753b38fdd9da6092968
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/23/6
- http://www.openwall.com/lists/oss-security/2016/09/23/8
- http://www.securityfocus.com/bid/93141
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01598.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01877.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a0d1cbdacff5df4ded16b753b38fdd9da6092968
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/23/6
- http://www.openwall.com/lists/oss-security/2016/09/23/8
- http://www.securityfocus.com/bid/93141
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01598.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01877.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM4.4
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=167d97a3def77ee2dbf6e908b0ecbfe2103977db
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/09/4
- http://www.openwall.com/lists/oss-security/2016/09/09/7
- http://www.securityfocus.com/bid/92904
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01764.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=167d97a3def77ee2dbf6e908b0ecbfe2103977db
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/09/4
- http://www.openwall.com/lists/oss-security/2016/09/09/7
- http://www.securityfocus.com/bid/92904
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01764.html
MEDIUM4.4
The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d251157ac1928191af851d199a9ff255d330bec9
- http://www.openwall.com/lists/oss-security/2016/09/16/3
- http://www.openwall.com/lists/oss-security/2016/09/16/9
- http://www.securityfocus.com/bid/92998
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03609.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d251157ac1928191af851d199a9ff255d330bec9
- http://www.openwall.com/lists/oss-security/2016/09/16/3
- http://www.openwall.com/lists/oss-security/2016/09/16/9
- http://www.securityfocus.com/bid/92998
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03609.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM6.0
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=973e7170dddefb491a48df5cba33b2ae151013a0
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/16/10
- http://www.openwall.com/lists/oss-security/2016/09/16/4
- http://www.securityfocus.com/bid/92996
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03546.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=973e7170dddefb491a48df5cba33b2ae151013a0
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/16/10
- http://www.openwall.com/lists/oss-security/2016/09/16/4
- http://www.securityfocus.com/bid/92996
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03546.html
- https://security.gentoo.org/glsa/201609-01
MEDIUM4.4
The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5
- http://www.openwall.com/lists/oss-security/2016/09/16/11
- http://www.openwall.com/lists/oss-security/2016/09/16/5
- http://www.securityfocus.com/bid/92997
- https://bugzilla.redhat.com/show_bug.cgi?id=1376776
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03604.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5
- http://www.openwall.com/lists/oss-security/2016/09/16/11
- http://www.openwall.com/lists/oss-security/2016/09/16/5
- http://www.securityfocus.com/bid/92997
- https://bugzilla.redhat.com/show_bug.cgi?id=1376776
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg03604.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b53dd4495ced2432a0b652ea895e651d07336f7e
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/19/8
- http://www.openwall.com/lists/oss-security/2016/09/20/3
- http://www.securityfocus.com/bid/93029
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b53dd4495ced2432a0b652ea895e651d07336f7e
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/09/19/8
- http://www.openwall.com/lists/oss-security/2016/09/20/3
- http://www.securityfocus.com/bid/93029
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM4.4
The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/1
- http://www.openwall.com/lists/oss-security/2016/10/03/4
- http://www.securityfocus.com/bid/93274
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/1
- http://www.openwall.com/lists/oss-security/2016/10/03/4
- http://www.securityfocus.com/bid/93274
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM4.4
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=070c4b92b8cd5390889716677a0b92444d6e087a
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/2
- http://www.openwall.com/lists/oss-security/2016/10/03/5
- http://www.securityfocus.com/bid/93273
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05557.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=070c4b92b8cd5390889716677a0b92444d6e087a
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/2
- http://www.openwall.com/lists/oss-security/2016/10/03/5
- http://www.securityfocus.com/bid/93273
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05557.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM4.4
The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/3
- http://www.openwall.com/lists/oss-security/2016/10/03/6
- http://www.securityfocus.com/bid/93275
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/03/3
- http://www.openwall.com/lists/oss-security/2016/10/03/6
- http://www.securityfocus.com/bid/93275
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/07/2
- http://www.openwall.com/lists/oss-security/2016/10/08/3
- http://www.securityfocus.com/bid/93453
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg04083.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/07/2
- http://www.openwall.com/lists/oss-security/2016/10/08/3
- http://www.securityfocus.com/bid/93453
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg04083.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b16c129daf0fed91febbb88de23dae8271c8898a
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/07/3
- http://www.openwall.com/lists/oss-security/2016/10/08/4
- http://www.securityfocus.com/bid/93454
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg06609.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b16c129daf0fed91febbb88de23dae8271c8898a
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/07/3
- http://www.openwall.com/lists/oss-security/2016/10/08/4
- http://www.securityfocus.com/bid/93454
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg06609.html
MEDIUM6.0
The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=05f43d44e4bc26611ce25fd7d726e483f73363ce
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/12
- http://www.openwall.com/lists/oss-security/2016/10/10/6
- http://www.securityfocus.com/bid/93469
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01265.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=05f43d44e4bc26611ce25fd7d726e483f73363ce
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/12
- http://www.openwall.com/lists/oss-security/2016/10/10/6
- http://www.securityfocus.com/bid/93469
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01265.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e95c9a493a5a8d6f969e86c9f19f80ffe6587e19
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/13
- http://www.openwall.com/lists/oss-security/2016/10/10/7
- http://www.securityfocus.com/bid/93473
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e95c9a493a5a8d6f969e86c9f19f80ffe6587e19
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/13
- http://www.openwall.com/lists/oss-security/2016/10/10/7
- http://www.securityfocus.com/bid/93473
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/14
- http://www.openwall.com/lists/oss-security/2016/10/10/8
- http://www.securityfocus.com/bid/93474
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07143.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/10/14
- http://www.openwall.com/lists/oss-security/2016/10/10/8
- http://www.securityfocus.com/bid/93474
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07143.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/6
- http://www.openwall.com/lists/oss-security/2016/10/15/4
- http://www.securityfocus.com/bid/93567
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02577.html
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/6
- http://www.openwall.com/lists/oss-security/2016/10/15/4
- http://www.securityfocus.com/bid/93567
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02577.html
MEDIUM6.0
The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/8
- http://www.openwall.com/lists/oss-security/2016/10/15/9
- http://www.securityfocus.com/bid/93566
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02501.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/8
- http://www.openwall.com/lists/oss-security/2016/10/15/9
- http://www.securityfocus.com/bid/93566
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02501.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/9
- http://www.openwall.com/lists/oss-security/2016/10/15/5
- http://www.securityfocus.com/bid/93563
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3592fe0c919cf27a81d8e9f9b4f269553418bb01
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/14/9
- http://www.openwall.com/lists/oss-security/2016/10/15/5
- http://www.securityfocus.com/bid/93563
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/24/1
- http://www.openwall.com/lists/oss-security/2016/10/24/4
- http://www.securityfocus.com/bid/93842
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04682.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/24/1
- http://www.openwall.com/lists/oss-security/2016/10/24/4
- http://www.securityfocus.com/bid/93842
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04682.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/24/2
- http://www.openwall.com/lists/oss-security/2016/10/24/5
- http://www.securityfocus.com/bid/93844
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/24/2
- http://www.openwall.com/lists/oss-security/2016/10/24/5
- http://www.securityfocus.com/bid/93844
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/27/14
- http://www.openwall.com/lists/oss-security/2016/10/30/5
- http://www.securityfocus.com/bid/93957
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03024.html
- https://security.gentoo.org/glsa/201701-49
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/27/14
- http://www.openwall.com/lists/oss-security/2016/10/30/5
- http://www.securityfocus.com/bid/93957
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03024.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.0
Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff55e94d23ae94c8628b0115320157c763eb3e06
- http://www.openwall.com/lists/oss-security/2016/10/27/15
- http://www.openwall.com/lists/oss-security/2016/10/30/6
- http://www.securityfocus.com/bid/93962
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01861.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff55e94d23ae94c8628b0115320157c763eb3e06
- http://www.openwall.com/lists/oss-security/2016/10/27/15
- http://www.openwall.com/lists/oss-security/2016/10/30/6
- http://www.securityfocus.com/bid/93962
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01861.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb687602853b4ae656e9236ee4222609f3a6887d
- http://www.openwall.com/lists/oss-security/2016/10/28/1
- http://www.openwall.com/lists/oss-security/2016/10/30/7
- http://www.securityfocus.com/bid/93955
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb687602853b4ae656e9236ee4222609f3a6887d
- http://www.openwall.com/lists/oss-security/2016/10/28/1
- http://www.openwall.com/lists/oss-security/2016/10/30/7
- http://www.securityfocus.com/bid/93955
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM4.4
Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/2
- http://www.openwall.com/lists/oss-security/2016/10/30/8
- http://www.securityfocus.com/bid/93956
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02942.html
- https://security.gentoo.org/glsa/201611-11
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/2
- http://www.openwall.com/lists/oss-security/2016/10/30/8
- http://www.securityfocus.com/bid/93956
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02942.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4c1586787ff43c9acd18a56c12d720e3e6be9f7c
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/3
- http://www.openwall.com/lists/oss-security/2016/10/30/9
- http://www.securityfocus.com/bid/93965
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02608.html
- https://security.gentoo.org/glsa/201611-11
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4c1586787ff43c9acd18a56c12d720e3e6be9f7c
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/3
- http://www.openwall.com/lists/oss-security/2016/10/30/9
- http://www.securityfocus.com/bid/93965
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02608.html
- https://security.gentoo.org/glsa/201611-11
MEDIUM6.0
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdfcc9aeea1492f4b819a24c94dfb678145b1bf9
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/4
- http://www.openwall.com/lists/oss-security/2016/10/30/10
- http://www.securityfocus.com/bid/93964
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02623.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdfcc9aeea1492f4b819a24c94dfb678145b1bf9
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/28/4
- http://www.openwall.com/lists/oss-security/2016/10/30/10
- http://www.securityfocus.com/bid/93964
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02623.html
HIGH7.5
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.
CVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HСсылки
- http://www.securityfocus.com/bid/94476
- http://www.securitytracker.com/id/1037344
- http://xenbits.xen.org/xsa/advisory-197.html
- https://security.gentoo.org/glsa/201612-56
- https://support.citrix.com/article/CTX218775
- http://www.securityfocus.com/bid/94476
- http://www.securitytracker.com/id/1037344
- http://xenbits.xen.org/xsa/advisory-197.html
- https://security.gentoo.org/glsa/201612-56
- https://support.citrix.com/article/CTX218775
HIGH8.8
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/01/17/12
- http://www.securityfocus.com/bid/95461
- http://www.securitytracker.com/id/1037604
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html
- https://security.gentoo.org/glsa/201704-01
- http://www.openwall.com/lists/oss-security/2017/01/17/12
- http://www.securityfocus.com/bid/95461
- http://www.securitytracker.com/id/1037604
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html
- https://security.gentoo.org/glsa/201704-01
CRITICAL9.9
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CCVSS 3.xКРИТИЧЕСКАЯ 9.9
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HСсылки
- http://www.securityfocus.com/bid/96893
- http://www.securitytracker.com/id/1038023
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0985
- https://access.redhat.com/errata/RHSA-2017:0987
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603
- https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- https://support.citrix.com/article/CTX221578
- http://www.securityfocus.com/bid/96893
- http://www.securitytracker.com/id/1038023
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0985
- https://access.redhat.com/errata/RHSA-2017:0987
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9603
- https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- https://support.citrix.com/article/CTX221578
MEDIUM5.5
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/02/3
- http://www.openwall.com/lists/oss-security/2016/12/02/8
- http://www.securityfocus.com/bid/94638
- https://bugzilla.redhat.com/show_bug.cgi?id=1400829
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/02/3
- http://www.openwall.com/lists/oss-security/2016/12/02/8
- http://www.securityfocus.com/bid/94638
- https://bugzilla.redhat.com/show_bug.cgi?id=1400829
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NСсылки
- http://www.openwall.com/lists/oss-security/2016/12/05/15
- http://www.openwall.com/lists/oss-security/2016/12/05/22
- http://www.securityfocus.com/bid/94763
- https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg00019.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/05/15
- http://www.openwall.com/lists/oss-security/2016/12/05/22
- http://www.securityfocus.com/bid/94763
- https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg00019.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/05/18
- http://www.openwall.com/lists/oss-security/2016/12/05/23
- http://www.securityfocus.com/bid/94765
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg00029.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/05/18
- http://www.openwall.com/lists/oss-security/2016/12/05/23
- http://www.securityfocus.com/bid/94765
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg00029.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/08/3
- http://www.securityfocus.com/bid/94759
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/08/3
- http://www.securityfocus.com/bid/94759
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
LOW3.3
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xНИЗКАЯ 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NMEDIUM6.5
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/08/5
- http://www.securityfocus.com/bid/94762
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/08/5
- http://www.securityfocus.com/bid/94762
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HMEDIUM6.5
Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4774718e5c194026ba5ee7a28d9be49be3080e42
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4774718e5c194026ba5ee7a28d9be49be3080e42
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in FileOperations.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=702dbcc274e2ca43be20ba64c758c0ca57dab91d
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=702dbcc274e2ca43be20ba64c758c0ca57dab91d
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the handle backend.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=971f406b77a6eb84e0ad27dcc416b663765aee30
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=971f406b77a6eb84e0ad27dcc416b663765aee30
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Memory leak in hw/9pfs/9p-proxy.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the proxy backend.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=898ae90a44551d25b8e956fd87372d303c82fe68
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=898ae90a44551d25b8e956fd87372d303c82fe68
- http://www.openwall.com/lists/oss-security/2016/12/06/11
- http://www.openwall.com/lists/oss-security/2016/12/08/7
- http://www.securityfocus.com/bid/94729
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg03278.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM6.5
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/09/1
- http://www.securityfocus.com/bid/94803
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
- http://www.openwall.com/lists/oss-security/2016/12/09/1
- http://www.securityfocus.com/bid/94803
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201701-49
MEDIUM5.5
The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=4299b90e9ba9ce5ca9024572804ba751aa1a7e70
- http://www.openwall.com/lists/oss-security/2016/12/09/1
- http://www.securityfocus.com/bid/94803
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1334398
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg00442.html
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=4299b90e9ba9ce5ca9024572804ba751aa1a7e70
- http://www.openwall.com/lists/oss-security/2016/12/09/1
- http://www.securityfocus.com/bid/94803
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1334398
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg00442.html
MEDIUM5.5
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HHIGH7.5
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/29/1
- http://www.securityfocus.com/bid/99513
- https://access.redhat.com/errata/RHSA-2017:2390
- https://access.redhat.com/errata/RHSA-2017:2445
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1466190
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/29/1
- http://www.securityfocus.com/bid/99513
- https://access.redhat.com/errata/RHSA-2017:2390
- https://access.redhat.com/errata/RHSA-2017:2445
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1466190
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html
MEDIUM5.5
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/07/1
- http://www.securityfocus.com/bid/99475
- https://bugzilla.redhat.com/show_bug.cgi?id=1468496
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg03087.html
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/07/1
- http://www.securityfocus.com/bid/99475
- https://bugzilla.redhat.com/show_bug.cgi?id=1468496
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg03087.html
MEDIUM4.4
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/17/4
- http://www.securityfocus.com/bid/99895
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1471638
- https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg03775.html
- https://usn.ubuntu.com/3575-1/
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/17/4
- http://www.securityfocus.com/bid/99895
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=1471638
- https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg03775.html
- https://usn.ubuntu.com/3575-1/
MEDIUM5.5
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/19/2
- http://www.securityfocus.com/bid/99923
- https://bugzilla.redhat.com/show_bug.cgi?id=1472611
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/07/19/2
- http://www.securityfocus.com/bid/99923
- https://bugzilla.redhat.com/show_bug.cgi?id=1472611
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html
MEDIUM6.5
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/21/2
- http://www.securityfocus.com/bid/100451
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg01850.html
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/21/2
- http://www.securityfocus.com/bid/100451
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg01850.html
MEDIUM5.5
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/30/3
- http://www.securityfocus.com/bid/100540
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://access.redhat.com/errata/RHSA-2018:2162
- https://bugzilla.redhat.com/show_bug.cgi?id=1486560
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04684.html
- https://usn.ubuntu.com/3575-1/
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/30/3
- http://www.securityfocus.com/bid/100540
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://access.redhat.com/errata/RHSA-2018:2162
- https://bugzilla.redhat.com/show_bug.cgi?id=1486560
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04684.html
- https://usn.ubuntu.com/3575-1/
HIGH7.5
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/29/6
- http://www.securityfocus.com/bid/100534
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=1486400
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg05201.html
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/08/29/6
- http://www.securityfocus.com/bid/100534
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=1486400
- https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg05201.html
HIGH8.8
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HСсылки
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/09/07/2
- http://www.securityfocus.com/bid/100694
- https://access.redhat.com/errata/RHSA-2017:3368
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01032.html
- https://usn.ubuntu.com/3575-1/
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/09/07/2
- http://www.securityfocus.com/bid/100694
- https://access.redhat.com/errata/RHSA-2017:3368
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01032.html
- https://usn.ubuntu.com/3575-1/
MEDIUM5.6
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 5.6
CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NСсылки
- http://www.openwall.com/lists/oss-security/2017/10/06/1
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.openwall.com/lists/oss-security/2017/10/06/1
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
CRITICAL9.8
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.securityfocus.com/bid/101975
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://usn.ubuntu.com/3575-1/
- https://www.exploit-db.com/exploits/43194/
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.securityfocus.com/bid/101975
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://usn.ubuntu.com/3575-1/
- https://www.exploit-db.com/exploits/43194/
HIGH8.6
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 8.6
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/11/28/9
- http://www.securityfocus.com/bid/102011
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.openwall.com/lists/oss-security/2017/11/28/9
- http://www.securityfocus.com/bid/102011
- https://access.redhat.com/errata/RHSA-2018:1104
- https://access.redhat.com/errata/RHSA-2018:1113
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
HIGH7.5
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.securityfocus.com/bid/101277
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugs.launchpad.net/qemu/+bug/1718964
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02278.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.securityfocus.com/bid/101277
- https://access.redhat.com/errata/RHSA-2018:0816
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugs.launchpad.net/qemu/+bug/1718964
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02278.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
MEDIUM6.0
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/10/12/16
- http://www.securityfocus.com/bid/101262
- https://access.redhat.com/errata/RHSA-2017:3368
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://access.redhat.com/errata/RHSA-2018:0516
- https://bugzilla.redhat.com/show_bug.cgi?id=1501290
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02557.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.openwall.com/lists/oss-security/2017/10/12/16
- http://www.securityfocus.com/bid/101262
- https://access.redhat.com/errata/RHSA-2017:3368
- https://access.redhat.com/errata/RHSA-2017:3369
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://access.redhat.com/errata/RHSA-2018:0516
- https://bugzilla.redhat.com/show_bug.cgi?id=1501290
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02557.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
MEDIUM6.5
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/12/05/2
- http://www.securityfocus.com/bid/102059
- https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg00166.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.openwall.com/lists/oss-security/2017/12/05/2
- http://www.securityfocus.com/bid/102059
- https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg00166.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
MEDIUM4.4
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2018/01/15/3
- http://www.securityfocus.com/bid/102520
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f153b563f8cf121aebf5a2fff5f0110faf58ccb3
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- http://www.openwall.com/lists/oss-security/2018/01/15/3
- http://www.securityfocus.com/bid/102520
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f153b563f8cf121aebf5a2fff5f0110faf58ccb3
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
MEDIUM5.5
Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2018/01/19/1
- http://www.securityfocus.com/bid/102759
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2098b073f398cd628c09c5a78537a6854
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
- http://www.openwall.com/lists/oss-security/2018/01/19/1
- http://www.securityfocus.com/bid/102759
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2098b073f398cd628c09c5a78537a6854
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
CRITICAL9.1
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CCVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HСсылки
- http://rhn.redhat.com/errata/RHSA-2017-0309.html
- http://rhn.redhat.com/errata/RHSA-2017-0328.html
- http://rhn.redhat.com/errata/RHSA-2017-0329.html
- http://rhn.redhat.com/errata/RHSA-2017-0330.html
- http://rhn.redhat.com/errata/RHSA-2017-0331.html
- http://rhn.redhat.com/errata/RHSA-2017-0332.html
- http://rhn.redhat.com/errata/RHSA-2017-0333.html
- http://rhn.redhat.com/errata/RHSA-2017-0334.html
- http://rhn.redhat.com/errata/RHSA-2017-0344.html
- http://rhn.redhat.com/errata/RHSA-2017-0350.html
- http://rhn.redhat.com/errata/RHSA-2017-0396.html
- http://rhn.redhat.com/errata/RHSA-2017-0454.html
- http://www.openwall.com/lists/oss-security/2017/02/01/6
- http://www.securityfocus.com/bid/95990
- http://www.securitytracker.com/id/1037804
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg00015.html
- https://security.gentoo.org/glsa/201702-27
- https://security.gentoo.org/glsa/201702-28
- https://support.citrix.com/article/CTX220771
- http://rhn.redhat.com/errata/RHSA-2017-0309.html
- http://rhn.redhat.com/errata/RHSA-2017-0328.html
- http://rhn.redhat.com/errata/RHSA-2017-0329.html
- http://rhn.redhat.com/errata/RHSA-2017-0330.html
- http://rhn.redhat.com/errata/RHSA-2017-0331.html
- http://rhn.redhat.com/errata/RHSA-2017-0332.html
- http://rhn.redhat.com/errata/RHSA-2017-0333.html
- http://rhn.redhat.com/errata/RHSA-2017-0334.html
- http://rhn.redhat.com/errata/RHSA-2017-0344.html
- http://rhn.redhat.com/errata/RHSA-2017-0350.html
- http://rhn.redhat.com/errata/RHSA-2017-0396.html
- http://rhn.redhat.com/errata/RHSA-2017-0454.html
- http://www.openwall.com/lists/oss-security/2017/02/01/6
- http://www.securityfocus.com/bid/95990
- http://www.securitytracker.com/id/1037804
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg00015.html
- https://security.gentoo.org/glsa/201702-27
- https://security.gentoo.org/glsa/201702-28
- https://support.citrix.com/article/CTX220771
CRITICAL9.9
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CCVSS 3.xКРИТИЧЕСКАЯ 9.9
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HСсылки
- http://rhn.redhat.com/errata/RHSA-2017-0328.html
- http://rhn.redhat.com/errata/RHSA-2017-0329.html
- http://rhn.redhat.com/errata/RHSA-2017-0330.html
- http://rhn.redhat.com/errata/RHSA-2017-0331.html
- http://rhn.redhat.com/errata/RHSA-2017-0332.html
- http://rhn.redhat.com/errata/RHSA-2017-0333.html
- http://rhn.redhat.com/errata/RHSA-2017-0334.html
- http://rhn.redhat.com/errata/RHSA-2017-0350.html
- http://rhn.redhat.com/errata/RHSA-2017-0351.html
- http://rhn.redhat.com/errata/RHSA-2017-0352.html
- http://rhn.redhat.com/errata/RHSA-2017-0396.html
- http://rhn.redhat.com/errata/RHSA-2017-0454.html
- http://www.openwall.com/lists/oss-security/2017/02/21/1
- http://www.securityfocus.com/bid/96378
- http://www.securitytracker.com/id/1037870
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620
- https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html
- https://security.gentoo.org/glsa/201703-07
- https://security.gentoo.org/glsa/201704-01
- https://support.citrix.com/article/CTX220771
- https://xenbits.xen.org/xsa/advisory-209.html
- http://rhn.redhat.com/errata/RHSA-2017-0328.html
- http://rhn.redhat.com/errata/RHSA-2017-0329.html
- http://rhn.redhat.com/errata/RHSA-2017-0330.html
- http://rhn.redhat.com/errata/RHSA-2017-0331.html
- http://rhn.redhat.com/errata/RHSA-2017-0332.html
- http://rhn.redhat.com/errata/RHSA-2017-0333.html
- http://rhn.redhat.com/errata/RHSA-2017-0334.html
- http://rhn.redhat.com/errata/RHSA-2017-0350.html
- http://rhn.redhat.com/errata/RHSA-2017-0351.html
- http://rhn.redhat.com/errata/RHSA-2017-0352.html
- http://rhn.redhat.com/errata/RHSA-2017-0396.html
- http://rhn.redhat.com/errata/RHSA-2017-0454.html
- http://www.openwall.com/lists/oss-security/2017/02/21/1
- http://www.securityfocus.com/bid/96378
- http://www.securitytracker.com/id/1037870
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620
- https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html
- https://security.gentoo.org/glsa/201703-07
- https://security.gentoo.org/glsa/201704-01
- https://support.citrix.com/article/CTX220771
- https://xenbits.xen.org/xsa/advisory-209.html
HIGH8.8
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
CVSS 2.0СРЕДНЯЯ 6.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/02/15/2
- http://www.securityfocus.com/bid/96265
- https://access.redhat.com/errata/RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html
- https://security.gentoo.org/glsa/201704-01
- http://www.openwall.com/lists/oss-security/2017/02/15/2
- http://www.securityfocus.com/bid/96265
- https://access.redhat.com/errata/RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html
- https://security.gentoo.org/glsa/201704-01
MEDIUM6.5
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401
- http://www.openwall.com/lists/oss-security/2017/01/17/19
- http://www.openwall.com/lists/oss-security/2017/01/18/7
- http://www.securityfocus.com/bid/95671
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401
- http://www.openwall.com/lists/oss-security/2017/01/17/19
- http://www.openwall.com/lists/oss-security/2017/01/18/7
- http://www.securityfocus.com/bid/95671
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
- http://www.openwall.com/lists/oss-security/2017/01/18/1
- http://www.openwall.com/lists/oss-security/2017/01/18/8
- http://www.securityfocus.com/bid/95669
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
- http://www.openwall.com/lists/oss-security/2017/01/18/1
- http://www.openwall.com/lists/oss-security/2017/01/18/8
- http://www.securityfocus.com/bid/95669
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
MEDIUM6.5
Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=33243031dad02d161225ba99d782616da133f689
- http://www.openwall.com/lists/oss-security/2017/01/20/17
- http://www.openwall.com/lists/oss-security/2017/01/21/5
- http://www.securityfocus.com/bid/95773
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=33243031dad02d161225ba99d782616da133f689
- http://www.openwall.com/lists/oss-security/2017/01/20/17
- http://www.openwall.com/lists/oss-security/2017/01/21/5
- http://www.securityfocus.com/bid/95773
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=204f01b30975923c64006f8067f0937b91eea68b
- http://www.openwall.com/lists/oss-security/2017/01/23/3
- http://www.openwall.com/lists/oss-security/2017/01/25/2
- http://www.securityfocus.com/bid/95781
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=204f01b30975923c64006f8067f0937b91eea68b
- http://www.openwall.com/lists/oss-security/2017/01/23/3
- http://www.openwall.com/lists/oss-security/2017/01/25/2
- http://www.securityfocus.com/bid/95781
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
- http://www.openwall.com/lists/oss-security/2017/01/24/8
- http://www.openwall.com/lists/oss-security/2017/01/25/3
- http://www.securityfocus.com/bid/95780
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
- http://www.openwall.com/lists/oss-security/2017/01/24/8
- http://www.openwall.com/lists/oss-security/2017/01/25/3
- http://www.securityfocus.com/bid/95780
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=42922105beb14c2fc58185ea022b9f72fb5465e9
- http://www.openwall.com/lists/oss-security/2017/01/30/2
- http://www.openwall.com/lists/oss-security/2017/01/31/10
- http://www.openwall.com/lists/oss-security/2017/02/12/1
- http://www.securityfocus.com/bid/95885
- https://bugzilla.redhat.com/show_bug.cgi?id=1417559
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=42922105beb14c2fc58185ea022b9f72fb5465e9
- http://www.openwall.com/lists/oss-security/2017/01/30/2
- http://www.openwall.com/lists/oss-security/2017/01/31/10
- http://www.openwall.com/lists/oss-security/2017/02/12/1
- http://www.securityfocus.com/bid/95885
- https://bugzilla.redhat.com/show_bug.cgi?id=1417559
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=765a707000e838c30b18d712fe6cb3dd8e0435f3
- http://www.openwall.com/lists/oss-security/2017/02/01/19
- http://www.openwall.com/lists/oss-security/2017/02/02/14
- http://www.securityfocus.com/bid/95999
- https://bugzilla.redhat.com/show_bug.cgi?id=1418342
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=765a707000e838c30b18d712fe6cb3dd8e0435f3
- http://www.openwall.com/lists/oss-security/2017/02/01/19
- http://www.openwall.com/lists/oss-security/2017/02/02/14
- http://www.securityfocus.com/bid/95999
- https://bugzilla.redhat.com/show_bug.cgi?id=1418342
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28
MEDIUM6.5
Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=5e8e3c4c75c199aa1017db816fca02be2a9f8798
- http://www.openwall.com/lists/oss-security/2017/02/01/21
- http://www.openwall.com/lists/oss-security/2017/02/02/16
- http://www.securityfocus.com/bid/95993
- https://bugzilla.redhat.com/show_bug.cgi?id=1418382
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=5e8e3c4c75c199aa1017db816fca02be2a9f8798
- http://www.openwall.com/lists/oss-security/2017/02/01/21
- http://www.openwall.com/lists/oss-security/2017/02/02/16
- http://www.securityfocus.com/bid/95993
- https://bugzilla.redhat.com/show_bug.cgi?id=1418382
- https://security.gentoo.org/glsa/201702-28
MEDIUM5.5
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html
- http://www.openwall.com/lists/oss-security/2017/02/07/3
- http://www.securityfocus.com/bid/96112
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1419699
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html
- http://www.openwall.com/lists/oss-security/2017/02/07/3
- http://www.securityfocus.com/bid/96112
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1419699
- https://security.gentoo.org/glsa/201702-28
HIGH8.8
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.
CVSS 2.0ВЫСОКАЯ 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
- http://www.openwall.com/lists/oss-security/2017/02/08/2
- http://www.securityfocus.com/bid/96141
- https://bugzilla.redhat.com/show_bug.cgi?id=1420092
- https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.html
- https://security.gentoo.org/glsa/201702-28
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4
- http://www.openwall.com/lists/oss-security/2017/02/08/2
- http://www.securityfocus.com/bid/96141
- https://bugzilla.redhat.com/show_bug.cgi?id=1420092
- https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.html
- https://security.gentoo.org/glsa/201702-28
MEDIUM5.5
The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=f89b60f6e5fee3923bedf80e82b4e5efc1bb156b
- http://www.openwall.com/lists/oss-security/2017/02/13/11
- http://www.securityfocus.com/bid/96220
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1421626
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01101.html
- https://security.gentoo.org/glsa/201704-01
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=f89b60f6e5fee3923bedf80e82b4e5efc1bb156b
- http://www.openwall.com/lists/oss-security/2017/02/13/11
- http://www.securityfocus.com/bid/96220
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1421626
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01101.html
- https://security.gentoo.org/glsa/201704-01
MEDIUM5.5
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=6e86d90352adf6cb08295255220295cf23c4286e
- http://www.openwall.com/lists/oss-security/2017/02/14/8
- http://www.securityfocus.com/bid/96263
- https://bugzilla.redhat.com/show_bug.cgi?id=1421995
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02776.html
- https://security.gentoo.org/glsa/201704-01
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=6e86d90352adf6cb08295255220295cf23c4286e
- http://www.openwall.com/lists/oss-security/2017/02/14/8
- http://www.securityfocus.com/bid/96263
- https://bugzilla.redhat.com/show_bug.cgi?id=1421995
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02776.html
- https://security.gentoo.org/glsa/201704-01
HIGH7.5
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6
- http://www.openwall.com/lists/oss-security/2017/02/17/2
- http://www.securityfocus.com/bid/96277
- http://www.securitytracker.com/id/1037856
- https://bugzilla.redhat.com/show_bug.cgi?id=1423358
- https://lists.nongnu.org/archive/html/qemu-devel/2017-02/msg03527.html
- https://security.gentoo.org/glsa/201704-01
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6
- http://www.openwall.com/lists/oss-security/2017/02/17/2
- http://www.securityfocus.com/bid/96277
- http://www.securitytracker.com/id/1037856
- https://bugzilla.redhat.com/show_bug.cgi?id=1423358
- https://lists.nongnu.org/archive/html/qemu-devel/2017-02/msg03527.html
- https://security.gentoo.org/glsa/201704-01
MEDIUM6.5
The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb
- http://www.openwall.com/lists/oss-security/2017/03/06/6
- http://www.securityfocus.com/bid/96611
- https://bugzilla.redhat.com/show_bug.cgi?id=1429432
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201704-01
- http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb
- http://www.openwall.com/lists/oss-security/2017/03/06/6
- http://www.securityfocus.com/bid/96611
- https://bugzilla.redhat.com/show_bug.cgi?id=1429432
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201704-01
MEDIUM6.0
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d63fb193e71644a073b77ff5ac6f1216f2f6cf6e
- http://www.openwall.com/lists/oss-security/2017/04/03/2
- http://www.securityfocus.com/bid/97319
- https://bugzilla.redhat.com/show_bug.cgi?id=1437871
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05449.html
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d63fb193e71644a073b77ff5ac6f1216f2f6cf6e
- http://www.openwall.com/lists/oss-security/2017/04/03/2
- http://www.securityfocus.com/bid/97319
- https://bugzilla.redhat.com/show_bug.cgi?id=1437871
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05449.html
- https://security.gentoo.org/glsa/201706-03
CRITICAL9.0
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
CVSS 2.0ВЫСОКАЯ 7.7
CVSS:2.0/AV:A/AC:L/Au:S/C:C/I:C/A:CCVSS 3.xКРИТИЧЕСКАЯ 9.0
CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/04/19/2
- http://www.securityfocus.com/bid/97970
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c0c060e
- https://security.gentoo.org/glsa/201706-03
- http://www.openwall.com/lists/oss-security/2017/04/19/2
- http://www.securityfocus.com/bid/97970
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c0c060e
- https://security.gentoo.org/glsa/201706-03
HIGH7.8
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
CVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://seclists.org/oss-sec/2017/q2/278
- http://www.securityfocus.com/bid/98574
- https://bugzilla.redhat.com/show_bug.cgi?id=1451709
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg03663.html
- https://security.gentoo.org/glsa/201706-03
- http://seclists.org/oss-sec/2017/q2/278
- http://www.securityfocus.com/bid/98574
- https://bugzilla.redhat.com/show_bug.cgi?id=1451709
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg03663.html
- https://security.gentoo.org/glsa/201706-03
HIGH7.5
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/07/21/4
- http://www.securityfocus.com/bid/99944
- https://access.redhat.com/errata/RHSA-2017:2628
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7539
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=2b0bbc4f8809c972bad134bc1a2570dbb01dea0b
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=ff82911cd3f69f028f2537825c9720ff78bc3f19
- http://www.openwall.com/lists/oss-security/2017/07/21/4
- http://www.securityfocus.com/bid/99944
- https://access.redhat.com/errata/RHSA-2017:2628
- https://access.redhat.com/errata/RHSA-2017:3466
- https://access.redhat.com/errata/RHSA-2017:3470
- https://access.redhat.com/errata/RHSA-2017:3471
- https://access.redhat.com/errata/RHSA-2017:3472
- https://access.redhat.com/errata/RHSA-2017:3473
- https://access.redhat.com/errata/RHSA-2017:3474
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7539
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=2b0bbc4f8809c972bad134bc1a2570dbb01dea0b
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=ff82911cd3f69f028f2537825c9720ff78bc3f19
MEDIUM5.5
hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=215902d7b6fb50c6fc216fc74f770858278ed904
- http://www.openwall.com/lists/oss-security/2017/04/19/4
- http://www.securityfocus.com/bid/97957
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1430
- https://access.redhat.com/errata/RHSA-2017:1431
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=1443441
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=215902d7b6fb50c6fc216fc74f770858278ed904
- http://www.openwall.com/lists/oss-security/2017/04/19/4
- http://www.securityfocus.com/bid/97957
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1430
- https://access.redhat.com/errata/RHSA-2017:1431
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=1443441
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
HIGH7.8
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
CVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HСсылки
- http://ubuntu.com/usn/usn-3289-1
- http://www.openwall.com/lists/oss-security/2017/04/21/1
- http://www.securityfocus.com/bid/102129
- http://www.securityfocus.com/bid/97955
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1430
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=1430056
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- https://support.citrix.com/article/CTX230138
- http://ubuntu.com/usn/usn-3289-1
- http://www.openwall.com/lists/oss-security/2017/04/21/1
- http://www.securityfocus.com/bid/102129
- http://www.securityfocus.com/bid/97955
- https://access.redhat.com/errata/RHSA-2017:0980
- https://access.redhat.com/errata/RHSA-2017:0981
- https://access.redhat.com/errata/RHSA-2017:0982
- https://access.redhat.com/errata/RHSA-2017:0983
- https://access.redhat.com/errata/RHSA-2017:0984
- https://access.redhat.com/errata/RHSA-2017:0988
- https://access.redhat.com/errata/RHSA-2017:1205
- https://access.redhat.com/errata/RHSA-2017:1206
- https://access.redhat.com/errata/RHSA-2017:1430
- https://access.redhat.com/errata/RHSA-2017:1441
- https://bugzilla.redhat.com/show_bug.cgi?id=1430056
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- https://support.citrix.com/article/CTX230138
MEDIUM6.5
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ffcdef4277a91af15a3c09f7d16af072c29f3f2
- http://www.openwall.com/lists/oss-security/2017/04/25/5
- http://www.securityfocus.com/bid/98012
- https://bugzilla.redhat.com/show_bug.cgi?id=1444781
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg01636.html
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ffcdef4277a91af15a3c09f7d16af072c29f3f2
- http://www.openwall.com/lists/oss-security/2017/04/25/5
- http://www.securityfocus.com/bid/98012
- https://bugzilla.redhat.com/show_bug.cgi?id=1444781
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg01636.html
- https://security.gentoo.org/glsa/201706-03
MEDIUM6.5
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/04/26/5
- http://www.securityfocus.com/bid/98015
- https://bugzilla.redhat.com/show_bug.cgi?id=1445621
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04578.html
- https://security.gentoo.org/glsa/201706-03
- http://www.openwall.com/lists/oss-security/2017/04/26/5
- http://www.securityfocus.com/bid/98015
- https://bugzilla.redhat.com/show_bug.cgi?id=1445621
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04578.html
- https://security.gentoo.org/glsa/201706-03
HIGH7.0
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
CVSS 2.0СРЕДНЯЯ 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xВЫСОКАЯ 7.0
CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HHIGH7.5
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.securityfocus.com/bid/98302
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html
- https://security.gentoo.org/glsa/201706-03
- http://www.securityfocus.com/bid/98302
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html
- https://security.gentoo.org/glsa/201706-03
MEDIUM6.5
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/05/03/2
- http://www.securityfocus.com/bid/98277
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html
- https://security.gentoo.org/glsa/201706-03
- http://www.openwall.com/lists/oss-security/2017/05/03/2
- http://www.securityfocus.com/bid/98277
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html
- https://security.gentoo.org/glsa/201706-03
MEDIUM5.5
Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=dd248ed7e204ee8a1873914e02b8b526e8f1b80d
- http://www.openwall.com/lists/oss-security/2017/05/19/1
- http://www.securityfocus.com/bid/98632
- https://bugzilla.redhat.com/show_bug.cgi?id=1452597
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=dd248ed7e204ee8a1873914e02b8b526e8f1b80d
- http://www.openwall.com/lists/oss-security/2017/05/19/1
- http://www.securityfocus.com/bid/98632
- https://bugzilla.redhat.com/show_bug.cgi?id=1452597
- https://security.gentoo.org/glsa/201706-03
MEDIUM5.6
QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.6
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4154c7e03fa55b4cf52509a83d50d6c09d743b7
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/05/31/1
- http://www.securityfocus.com/bid/98766
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1452620
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4154c7e03fa55b4cf52509a83d50d6c09d743b7
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/05/31/1
- http://www.securityfocus.com/bid/98766
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1452620
- https://security.gentoo.org/glsa/201706-03
MEDIUM5.6
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.6
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=26f670a244982335cc08943fb1ec099a2c81e42d
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/01/3
- http://www.securityfocus.com/bid/98779
- https://bugzilla.redhat.com/show_bug.cgi?id=1457697
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=26f670a244982335cc08943fb1ec099a2c81e42d
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/01/3
- http://www.securityfocus.com/bid/98779
- https://bugzilla.redhat.com/show_bug.cgi?id=1457697
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201706-03
MEDIUM5.5
Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d68f0f778e7f4fbd674627274267f269e40f0b04
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/05/1
- http://www.securityfocus.com/bid/98921
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458270
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d68f0f778e7f4fbd674627274267f269e40f0b04
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/05/1
- http://www.securityfocus.com/bid/98921
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458270
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
MEDIUM5.5
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/06/3
- http://www.securityfocus.com/bid/98905
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0
- http://www.debian.org/security/2017/dsa-3920
- http://www.openwall.com/lists/oss-security/2017/06/06/3
- http://www.securityfocus.com/bid/98905
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
MEDIUM5.5
QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=96d87bdda3919bb16f754b3d3fd1227e1f38f13c
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/06/05/2
- http://www.securityfocus.com/bid/98915
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458744
- https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=96d87bdda3919bb16f754b3d3fd1227e1f38f13c
- http://www.debian.org/security/2017/dsa-3991
- http://www.openwall.com/lists/oss-security/2017/06/05/2
- http://www.securityfocus.com/bid/98915
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1458744
- https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
MEDIUM5.5
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/06/08/1
- http://www.securityfocus.com/bid/99010
- https://bugzilla.redhat.com/show_bug.cgi?id=1459477
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01309.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01313.html
- http://www.openwall.com/lists/oss-security/2017/06/08/1
- http://www.securityfocus.com/bid/99010
- https://bugzilla.redhat.com/show_bug.cgi?id=1459477
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01309.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01313.html
HIGH7.5
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/06/12/1
- http://www.securityfocus.com/bid/99011
- https://access.redhat.com/errata/RHSA-2017:1681
- https://access.redhat.com/errata/RHSA-2017:1682
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06240.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02321.html
- http://www.debian.org/security/2017/dsa-3925
- http://www.openwall.com/lists/oss-security/2017/06/12/1
- http://www.securityfocus.com/bid/99011
- https://access.redhat.com/errata/RHSA-2017:1681
- https://access.redhat.com/errata/RHSA-2017:1682
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06240.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02321.html