Every CVE Search/ Get API key

CVE-2011-4111

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in...

6.8 MediumFix available

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Exploit likelihood

2.26%Down 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
CVE-2011-4111
CVSS 2.0
6.8 MediumAV:A/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
CVE-2011-4111
Updated
2026-11-02
EUVDEUVD-2011-4059 No score

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
EUVD-2011-4059
Updated
2026-11-03
GitHub AdvisoriesGHSA-4c3m-mrr2-fw4x No score

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in...

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
GHSA-4c3m-mrr2-fw4x
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
CVE-2011-4111
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4111 No score

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Record
DEBIAN-CVE-2011-4111
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Debian:12
 before 0.15.1+dfsg-2
0.15.1+dfsg-2
qemu
Debian:13
 before 0.15.1+dfsg-2
0.15.1+dfsg-2
qemu
Debian:14
 before 0.15.1+dfsg-2
0.15.1+dfsg-2
xen
Debian:12
 before 4.4.0-1
4.4.0-1
xen
Debian:13
 before 4.4.0-1
4.4.0-1
xen
Debian:14
 before 4.4.0-1
4.4.0-1
qemu-img
Red Hat:enterprise_linux:6::client
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm
Red Hat:enterprise_linux:6::client
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::client
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-tools
Red Hat:enterprise_linux:6::client
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
qemu-img
Red Hat:enterprise_linux:6::computenode
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm
Red Hat:enterprise_linux:6::computenode
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-tools
Red Hat:enterprise_linux:6::computenode
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-img
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-tools
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-img
Red Hat:enterprise_linux:6::workstation
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm
Red Hat:enterprise_linux:6::workstation
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-kvm-tools
Red Hat:enterprise_linux:6::workstation
 before 2:0.12.1.2-2.209.el6_2.1
2:0.12.1.2-2.209.el6_2.1
qemu-img
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.160.el6_1.9
2:0.12.1.2-2.160.el6_1.9
qemu-kvm
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.160.el6_1.9
2:0.12.1.2-2.160.el6_1.9
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.160.el6_1.9
2:0.12.1.2-2.160.el6_1.9
qemu-kvm-tools
Red Hat:enterprise_linux:6::server
 before 2:0.12.1.2-2.160.el6_1.9
2:0.12.1.2-2.160.el6_1.9

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4111 is a medium vulnerability (CVSS 6.8) in Qemu, published February 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.26%, the 83rd percentile. Fixed in qemu 0.15.1+dfsg-2.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open