Every CVESearch/Get API key

CVE-2014-3689

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu...

7.2 HighFix available

CVE-2014-3689 is a high vulnerability (CVSS 7.2) in Qemu, published October 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in qemu 2.1+dfsg-6.

What does this mean?
Severity
7.2 HighCVSS 2.0, NVD
Exploit chance
0.39%EPSS, 33rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.1+dfsg-6qemu +31 more

Description

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Exploit likelihood

0.39%Down 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Debian:12
before 2.1+dfsg-6
2.1+dfsg-6
qemu
Debian:13
before 2.1+dfsg-6
2.1+dfsg-6
qemu
Debian:14
before 2.1+dfsg-6
2.1+dfsg-6
qemu
Debian:7
From an advisory covering 2 CVEs
before 1.1.2+dfsg-6a+deb7u5, plus listed versions
1.1.2+dfsg-6a1.1.2+dfsg-6a+deb7u11.1.2+dfsg-6a+deb7u21.1.2+dfsg-6a+deb7u31.1.2+dfsg-6a+deb7u4
1.1.2+dfsg-6a+deb7u5
qemu-kvm
Debian:7
From an advisory covering 2 CVEs
before 1.1.2+dfsg-6+deb7u5, plus listed versions
1.1.2+dfsg-61.1.2+dfsg-6+deb7u11.1.2+dfsg-6+deb7u21.1.2+dfsg-6+deb7u31.1.2+dfsg-6+deb7u4
1.1.2+dfsg-6+deb7u5
qemu
Mageia:4
From an advisory covering 3 CVEs
before 1.6.2-1.5.mga4
1.6.2-1.5.mga4
usbredir
Mageia:4
From an advisory covering 3 CVEs
before 0.6-1.mga4
0.6-1.mga4
xen
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 43 CVEs
before 4.5.2_06-7.1
4.5.2_06-7.1
xen
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 43 CVEs
before 4.5.2_06-7.1
4.5.2_06-7.1
xen
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 43 CVEs
before 4.5.2_06-7.1
4.5.2_06-7.1
Show 22 moreShow less
Affected packages
PackageAffectedFixed
xen
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 43 CVEs
before 4.5.2_06-7.1
4.5.2_06-7.1
xen
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 46 CVEs
before 4.4.4_02-32.1
4.4.4_02-32.1
xen
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 46 CVEs
before 4.4.4_02-32.1
4.4.4_02-32.1
xen
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 46 CVEs
before 4.4.4_02-32.1
4.4.4_02-32.1
xen
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 46 CVEs
before 4.4.4_02-32.1
4.4.4_02-32.1
xen
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 26 CVEs
before 4.1.6_08-26.1
4.1.6_08-26.1
xen
SUSE:Linux Enterprise Desktop 12
From an advisory covering 45 CVEs
before 4.4.4_02-22.19.1
4.4.4_02-22.19.1
xen
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 45 CVEs
before 4.4.4_02-22.19.1
4.4.4_02-22.19.1
xen
SUSE:Linux Enterprise Server 12
From an advisory covering 45 CVEs
before 4.4.4_02-22.19.1
4.4.4_02-22.19.1
xen
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 45 CVEs
before 4.4.4_02-22.19.1
4.4.4_02-22.19.1
qemu
SUSE:Linux Enterprise Desktop 12
From an advisory covering 37 CVEs
before 2.0.2-48.19.1
2.0.2-48.19.1
qemu
SUSE:Linux Enterprise Server 12
From an advisory covering 37 CVEs
before 2.0.2-48.19.1
2.0.2-48.19.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 37 CVEs
before 2.0.2-48.19.1
2.0.2-48.19.1
kvm
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 33 CVEs
before 1.4.2-46.1
1.4.2-46.1
kvm
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 33 CVEs
before 1.4.2-46.1
1.4.2-46.1
xen
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 35 CVEs
before 4.2.5_20-24.9
4.2.5_20-24.9
kvm
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 33 CVEs
before 1.4.2-44.1
1.4.2-44.1
kvm
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 33 CVEs
before 1.4.2-44.1
1.4.2-44.1
kvm
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 15 CVEs
before 1.4.2-60.34.1
1.4.2-60.34.1
kvm
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 21 CVEs
before 1.4.2-53.38.1
1.4.2-53.38.1
qemu
Ubuntu:14.04:LTS
before 2.0.0+dfsg-2ubuntu1.7, plus listed versions
1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3
Show 27 moreShow less
1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.6
2.0.0+dfsg-2ubuntu1.7
qemu
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
before 2.0.0+dfsg-2ubuntu1.7, plus listed versions
1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3
Show 27 moreShow less
1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.6
2.0.0+dfsg-2ubuntu1.7

What each source reports

NVD Score used7.2

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
CVE-2014-3689
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-269
Updated
2026-11-02
CVE ListNo score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
CVE-2014-3689
Updated
2026-11-02
EUVDEUVD-2014-3635No score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
EUVD-2014-3635
Updated
2026-11-03
GitHub AdvisoriesGHSA-4563-6q26-9q79No score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu...

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
GHSA-4563-6q26-9q79
Weakness
CWE-269
Updated
2026-11-02
OSVNo score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
CVE-2014-3689
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3689No score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
DEBIAN-CVE-2014-3689
Updated
2026-11-02
Show 13 moreShow less
OSVMGASA-2014-0467No score

Updated qemu packages fix security vulnerabilities

The Advanced Threat Research team at Intel Security reported that guest provided parameter were insufficiently validated in rectangle functions in the vmware-vga driver. A privileged guest user could use this flaw to write into qemu address space on the host, potentially escalating their privileges to those of the qemu host process (CVE-2014-3689).

It was discovered that QEMU incorrectly handled USB xHCI controller live migration. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code (CVE-2014-5263).

James Spadaro of Cisco reported insufficiently sanitized bits_per_pixel from the client in the QEMU VNC display driver. An attacker having access to the guest's VNC console could use this flaw to crash the guest (CVE-2014-7815).

Additionally, the qemu update in MGASA-2014-0426 did not have USB redirection support because Qemu 1.6.2 requires an updated libusbredirparser library. This update has been built against the updated usbredirparser library.

Record
MGASA-2014-0467
Updated
2026-11-02
OSVSUSE-SU-2016:0873-1No score

Security update for xen

xen was updated to fix 44 security issues.

These security issues were fixed:

  • CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).
  • CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).
  • CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).
  • CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).
  • CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).
  • CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
  • CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).
  • CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).
  • CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).
  • CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).
  • CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
  • CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).
  • CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).
  • CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).
  • CVE-2015-8504: VNC: floating point exception (bsc#958491).
  • CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).
  • CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).
  • CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).
  • CVE-2015-8558: Infinite loop in…
Record
SUSE-SU-2016:0873-1
Updated
2026-11-02
OSVSUSE-SU-2016:0955-1No score

Security update for xen

xen was updated to fix 47 security issues.

These security issues were fixed:

  • CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).
  • CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).
  • CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).
  • CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).
  • CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).
  • CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).
  • CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).
  • CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).
  • CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
  • CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).
  • CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).
  • CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).
  • CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).
  • CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
  • CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute…
Record
SUSE-SU-2016:0955-1
Updated
2026-11-02
OSVSUSE-SU-2016:1154-1No score

Security update for xen

xen was updated to fix 27 security issues.

These security issues were fixed:

  • CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).
  • CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).
  • CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).
  • CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).
  • CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).
  • CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
  • CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).
  • CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).
  • CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).
  • CVE-2015-8504: VNC: floating point exception (bsc#958491).
  • CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).
  • CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).
  • CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).
  • CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).
  • CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).
  • CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).
  • CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).
  • CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).
  • CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).
  • CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).
  • CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315). -…
Record
SUSE-SU-2016:1154-1
Updated
2026-11-02
OSVSUSE-SU-2016:1318-1No score

Security update for xen

xen was updated to fix 46 security issues.

These security issues were fixed:

  • CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).
  • CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).
  • CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).
  • CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#964644).
  • CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).
  • CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).
  • CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).
  • CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).
  • CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).
  • CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).
  • CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).
  • CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).
  • CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).
  • CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).
  • CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).
  • CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute…
Record
SUSE-SU-2016:1318-1
Updated
2026-11-02
OSVSUSE-SU-2016:1560-1No score

Security update for qemu

qemu was updated to fix 37 security issues.

These security issues were fixed:

  • CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)
  • CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)
  • CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)
  • CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121)
  • CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122)
  • CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)
  • CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)
  • CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)
  • CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)
  • CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)
  • CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)
  • CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)
  • CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)
  • CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)
  • CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)
  • CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)
  • CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)
  • CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)
  • CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).
  • CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).
  • CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).
  • CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).
  • CVE-2015-7549: PCI null pointer dereferences (bsc#958917).
  • CVE-2015-8504: VNC floating point exception (bsc#958491).
  • CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).
  • CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).
  • CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).
  • CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).
  • CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).
  • CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).
  • CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).
  • CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).
  • CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).
  • CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).
  • CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).
  • CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).
  • CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).

This non-security issue was fixed

  • bsc#886378: qemu truncates vhd images in virt-rescue
Record
SUSE-SU-2016:1560-1
Updated
2026-11-02
OSVSUSE-SU-2016:1698-1No score

Security update for kvm

kvm was updated to fix 33 security issues.

These security issues were fixed:

  • CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)
  • CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)
  • CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)
  • CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)
  • CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)
  • CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)
  • CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)
  • CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)
  • CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)
  • CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)
  • CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)
  • CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)
  • CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)
  • CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)
  • CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)
  • CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).
  • CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).
  • CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).
  • CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
  • CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).
  • CVE-2015-7549: PCI null pointer dereferences (bsc#958917).
  • CVE-2015-8504: VNC floating point exception (bsc#958491).
  • CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).
  • CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).
  • CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).
  • CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).
  • CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).
  • CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).
  • CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).
  • CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).
  • CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).

This non-security issue was fixed:

  • Fix case of IDE interface needing busy status set before flush (bsc#936132)
Record
SUSE-SU-2016:1698-1
Updated
2026-11-02
OSVSUSE-SU-2016:1745-1No score

Security update for xen

xen was updated to fix 36 security issues.

These security issues were fixed:

  • CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).
  • CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).
  • CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).
  • CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655).
  • CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).
  • CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).
  • CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).
  • CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).
  • CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
  • CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).
  • CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).
  • CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).
  • CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
  • CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).
  • CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).
  • CVE-2015-8504: VNC: floating point exception (bsc#958491). -…
Record
SUSE-SU-2016:1745-1
Updated
2026-11-02
OSVSUSE-SU-2016:1785-1No score

Security update for kvm

kvm was updated to fix 33 security issues.

These security issues were fixed:

  • CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)
  • CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)
  • CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)
  • CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)
  • CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)
  • CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)
  • CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)
  • CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)
  • CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)
  • CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)
  • CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)
  • CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)
  • CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)
  • CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)
  • CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)
  • CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).
  • CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).
  • CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
  • CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).
  • CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).
  • CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).
  • CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).
  • CVE-2015-7549: PCI null pointer dereferences (bsc#958917).
  • CVE-2015-8504: VNC floating point exception (bsc#958491).
  • CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).
  • CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).
  • CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).
  • CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).
  • CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).
  • CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).
  • CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).
  • CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).
  • CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).

This non-security issue was fixed:

  • Fix case of IDE interface needing busy status set before flush (bsc#936132)
Record
SUSE-SU-2016:1785-1
Updated
2026-11-02
OSVSUSE-SU-2021:14704-1No score

Security update for kvm

This update for kvm fixes the following issues:

  • Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)
  • Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)
  • Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)
  • Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)
  • Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)
  • Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)
  • Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)
  • Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)
  • Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)
  • Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)
  • Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)
  • Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)
Record
SUSE-SU-2021:14704-1
Updated
2026-11-02
OSVSUSE-SU-2021:14706-1No score

Security update for kvm

This update for kvm fixes the following issues:

  • Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)
  • Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)
  • Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)
  • Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)
  • Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)
  • Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)
  • Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)
  • Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)
  • Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)
  • Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)
  • Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • Fix use-after-free in slirp (CVE-2019-15890 bsc#1149811)
  • Fix for similar problems as for the original fix prompting this issue (CVE-2019-6778 bsc#1123156)
  • Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018 CVE-2020-7039 bsc#1161066)
  • Fix use after free in slirp (CVE-2020-1983 bsc#1170940)
  • Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)
  • Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)
  • Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)
Record
SUSE-SU-2021:14706-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3689No score

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Record
UBUNTU-CVE-2014-3689
Updated
2026-11-02
OSVUSN-2409-1No score

qemu, qemu-kvm vulnerabilities

Laszlo Ersek discovered that QEMU incorrectly handled memory in the vga device. A malicious guest could possibly use this issue to read arbitrary host memory. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3615)

Xavier Mehrenberger and Stephane Duverger discovered that QEMU incorrectly handled certain udp packets when using guest networking. A malicious guest could possibly use this issue to cause a denial of service. (CVE-2014-3640)

It was discovered that QEMU incorrectly handled parameter validation in the vmware_vga device. A malicious guest could possibly use this issue to write into memory of the host, leading to privilege escalation. (CVE-2014-3689)

It was discovered that QEMU incorrectly handled USB xHCI controller live migration. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-5263)

Michael S. Tsirkin discovered that QEMU incorrectly handled memory in the ACPI PCI hotplug interface. A malicious guest could possibly use this issue to access memory of the host, leading to information disclosure or privilege escalation. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-5388)

James Spadaro discovered that QEMU incorrectly handled certain VNC bytes_per_pixel values. An attacker having access to a VNC console could possibly use this issue to cause a guest to crash, resulting in a denial of service. (CVE-2014-7815)

Record
USN-2409-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 46 references and the rest of 5 source descriptions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open