Every CVE Search/ Get API key

CVE-2008-1945

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to...

2.1 LowFix available

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Exploit likelihood

0.47%Down 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.1

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
CVE-2008-1945
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE List No score

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
CVE-2008-1945
Updated
2026-11-02
EUVDEUVD-2008-1944 No score

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
EUVD-2008-1944
Updated
2026-11-03
GitHub AdvisoriesGHSA-vvm6-gvx4-5r3v No score

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to...

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
GHSA-vvm6-gvx4-5r3v
Updated
2026-11-02
OSV No score

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
CVE-2008-1945
Updated
2026-11-02
OSVDEBIAN-CVE-2008-1945 No score

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Record
DEBIAN-CVE-2008-1945
Updated
2026-11-02
OSVopenSUSE-SU-2024:10233-1 No score

qemu-2.6.1-1.5 on GA media

These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10233-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10285-1 No score

qemu-linux-user-2.6.1-1.5 on GA media

These are all security issues fixed in the qemu-linux-user-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10285-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Debian:12
 before 0.9.1-5
0.9.1-5
qemu
Debian:13
 before 0.9.1-5
0.9.1-5
qemu
Debian:14
 before 0.9.1-5
0.9.1-5
qemu
Debian:4.0
From an advisory covering 3 CVEs
 before 0.8.2-4etch3, plus listed versions
0.8.2-40.8.2-4etch10.8.2-4etch2
0.8.2-4etch3
qemu
Debian:5.0
From an advisory covering 3 CVEs
 before 0.9.1-10lenny1, plus listed versions
0.9.1-100.9.1-10lenny1~bpo40+1
0.9.1-10lenny1
xen
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-debuginfo
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-devel
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
Show 9 moreShow less
Affected packages
PackageAffectedFixed
xen-libs
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-debuginfo
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-devel
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
xen-libs
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.3
0:3.0.3-64.el5_2.3
qemu
openSUSE:Tumbleweed
From an advisory covering 53 CVEs
 before 2.6.1-1.5
2.6.1-1.5
qemu-linux-user
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 2.6.1-1.5
2.6.1-1.5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
aliases
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-1945 is a low vulnerability (CVSS 2.1) in Qemu, published August 8, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in qemu 0.9.1-5.

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open