{"id":"CVE-2008-0928","aliases":["DEBIAN-CVE-2008-0928","DSA-1799-1","DTSA-133-1","EUVD-2008-0935","GHSA-4gr3-prqp-v6r3","RHSA-2008:0194","openSUSE-SU-2024:10233-1","openSUSE-SU-2024:10285-1"],"status":"published","title":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests,...","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","severity":{"version":"2.0","score":4.7,"vector":"AV:L/AC:M/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00369,"percentile":0.30962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2008-03-03T22:00:00Z","modified":"2026-10-23T17:47:48Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["0.9.1+svn20081207-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["0.9.1+svn20081207-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["0.9.1+svn20081207-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1+svn20081207-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1+svn20081207-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1+svn20081207-1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-4etch3"}]}],"versions":["0.8.2-4","0.8.2-4etch1","0.8.2-4etch2"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-10lenny1"}]}],"versions":["0.9.1-10","0.9.1-10lenny1~bpo40+1"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60+dfsg-1+lenny1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-41.el5_1.5"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.5"}]}],"bundled":53},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.5"}]}],"bundled":12}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://www.redhat.com/archives/fedora-package-announce/2008-February/msg00850.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00852.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0194.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00900.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00957.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=433560","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/34642","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:016","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:162","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://marc.info/?l=debian-security\u0026m=120343592917055\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00857.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.redhat.com/archives/fedora-package-announce/2008-February/msg00830.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/29963","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9706","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/29129","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/28001","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2009/dsa-1799","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/29136","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35031","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/29081","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/29172","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0928","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4gr3-prqp-v6r3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-0928","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2008:0194","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=350421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=360381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=435495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=443078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=443390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=444583","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0194.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3919","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3919","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-5730","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5730","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-0928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1943","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1944","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2004","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2008-0928","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2008-03-03T22:00:00Z","modified":"2024-08-07T08:01:40.103Z","updated_at":"2026-11-02T14:34:48.505097Z"}],"euvd":[{"id":"EUVD-2008-0935","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2008-03-03T22:00:00Z","modified":"2024-08-07T08:01:40Z","updated_at":"2026-11-03T01:39:03.958401Z"}],"ghsa":[{"id":"GHSA-4gr3-prqp-v6r3","title":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests,...","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2022-05-01T23:34:47Z","modified":"2023-01-31T05:06:14Z","updated_at":"2026-11-02T14:48:59.585102Z"}],"nvd":[{"id":"CVE-2008-0928","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2008-03-03T22:44:00Z","modified":"2026-06-16T22:50:37.5Z","cvss":[{"version":"2.0","score":4.7,"vector":"AV:L/AC:M/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:25.307768Z"}],"osv":[{"id":"CVE-2008-0928","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2008-03-03T22:44:00Z","modified":"2026-04-10T03:39:39.377052Z","updated_at":"2026-11-02T15:43:57.178433Z"},{"id":"DEBIAN-CVE-2008-0928","description":"Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.","status":"published","published":"2008-03-03T22:44:00Z","modified":"2026-10-23T17:47:48.354569174Z","updated_at":"2026-11-02T15:45:23.411908Z"},{"id":"DSA-1799-1","title":"qemu - several vulnerabilities","status":"published","published":"2009-05-11T00:00:00Z","modified":"2026-03-09T01:22:58.482643Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DTSA-133-1","title":"kvm - multiple vulnerabilities","status":"published","published":"2008-05-24T00:00:00Z","modified":"2026-03-09T01:01:57.343933Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"openSUSE-SU-2024:10233-1","title":"qemu-2.6.1-1.5 on GA media","description":"These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:08.968833Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10285-1","title":"qemu-linux-user-2.6.1-1.5 on GA media","description":"These are all security issues fixed in the qemu-linux-user-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:03.73343Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2008:0194","title":"Red Hat Security Advisory: xen security and bug fix update","status":"published","published":"2024-09-15T17:16:00Z","modified":"2026-06-26T12:18:10.047631802Z","updated_at":"2026-11-02T15:52:59.70892Z"}]}}