{"id":"CVE-2013-4527","aliases":["DEBIAN-CVE-2013-4527","EUVD-2013-4386","GHSA-7hw2-3f8f-grrh","MGASA-2014-0426","RHSA-2014:0927","RHSA-2014:1268","SUSE-SU-2016:0955-1","SUSE-SU-2016:1318-1","SUSE-SU-2016:1745-1","UBUNTU-CVE-2013-4527","USN-2342-1","openSUSE-SU-2024:10233-1"],"status":"published","title":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute...","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05261,"percentile":0.92597,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-02-20T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.2.mga4"}]}],"bundled":34},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-60.el7_0.7"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_20-24.9"}]}],"bundled":35},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.3"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.3"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2"],"bundled":32},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.5"}]}],"bundled":53}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0927.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3f1c49e2136fa08ab1ef3183fd55def308829584","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4527","tags":["advisory"]},{"url":"http://git.qemu.org/?p=qemu.git;a=commitdiff;h=3f1c49e2136fa08ab1ef3183fd55def308829584"},{"url":"https://access.redhat.com/errata/RHSA-2014:0927","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1268","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066347","tags":["report"]},{"url":"https://github.com/advisories/GHSA-7hw2-3f8f-grrh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4527","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0426.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13096","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137578.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/140130.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0420.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0704.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0743.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1669.html","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2182-1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110219","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0927.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4148","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4149","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4150","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4151","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4527","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4529","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4529","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4529","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4535","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4536","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6399","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6399","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0222","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0223","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3461","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3461","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1268.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/897654","tags":["report"]},{"url":"https://bugzilla.suse.com/901508","tags":["report"]},{"url":"https://bugzilla.suse.com/902737","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/928393","tags":["report"]},{"url":"https://bugzilla.suse.com/945404","tags":["report"]},{"url":"https://bugzilla.suse.com/945989","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/956829","tags":["report"]},{"url":"https://bugzilla.suse.com/957162","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/958007","tags":["report"]},{"url":"https://bugzilla.suse.com/958009","tags":["report"]},{"url":"https://bugzilla.suse.com/958491","tags":["report"]},{"url":"https://bugzilla.suse.com/958523","tags":["report"]},{"url":"https://bugzilla.suse.com/958917","tags":["report"]},{"url":"https://bugzilla.suse.com/959005","tags":["report"]},{"url":"https://bugzilla.suse.com/959387","tags":["report"]},{"url":"https://bugzilla.suse.com/959695","tags":["report"]},{"url":"https://bugzilla.suse.com/959928","tags":["report"]},{"url":"https://bugzilla.suse.com/960334","tags":["report"]},{"url":"https://bugzilla.suse.com/960707","tags":["report"]},{"url":"https://bugzilla.suse.com/960725","tags":["report"]},{"url":"https://bugzilla.suse.com/960835","tags":["report"]},{"url":"https://bugzilla.suse.com/960861","tags":["report"]},{"url":"https://bugzilla.suse.com/960862","tags":["report"]},{"url":"https://bugzilla.suse.com/961332","tags":["report"]},{"url":"https://bugzilla.suse.com/961358","tags":["report"]},{"url":"https://bugzilla.suse.com/961691","tags":["report"]},{"url":"https://bugzilla.suse.com/962320","tags":["report"]},{"url":"https://bugzilla.suse.com/963782","tags":["report"]},{"url":"https://bugzilla.suse.com/963923","tags":["report"]},{"url":"https://bugzilla.suse.com/964413","tags":["report"]},{"url":"https://bugzilla.suse.com/965315","tags":["report"]},{"url":"https://bugzilla.suse.com/965317","tags":["report"]},{"url":"https://bugzilla.suse.com/967012","tags":["report"]},{"url":"https://bugzilla.suse.com/967013","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://bugzilla.suse.com/967969","tags":["report"]},{"url":"https://bugzilla.suse.com/969121","tags":["report"]},{"url":"https://bugzilla.suse.com/969122","tags":["report"]},{"url":"https://bugzilla.suse.com/969350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/956832","tags":["report"]},{"url":"https://bugzilla.suse.com/958493","tags":["report"]},{"url":"https://bugzilla.suse.com/958918","tags":["report"]},{"url":"https://bugzilla.suse.com/959006","tags":["report"]},{"url":"https://bugzilla.suse.com/960726","tags":["report"]},{"url":"https://bugzilla.suse.com/960836","tags":["report"]},{"url":"https://bugzilla.suse.com/961692","tags":["report"]},{"url":"https://bugzilla.suse.com/962321","tags":["report"]},{"url":"https://bugzilla.suse.com/962335","tags":["report"]},{"url":"https://bugzilla.suse.com/962360","tags":["report"]},{"url":"https://bugzilla.suse.com/962611","tags":["report"]},{"url":"https://bugzilla.suse.com/962627","tags":["report"]},{"url":"https://bugzilla.suse.com/962632","tags":["report"]},{"url":"https://bugzilla.suse.com/962642","tags":["report"]},{"url":"https://bugzilla.suse.com/962758","tags":["report"]},{"url":"https://bugzilla.suse.com/963783","tags":["report"]},{"url":"https://bugzilla.suse.com/964415","tags":["report"]},{"url":"https://bugzilla.suse.com/964431","tags":["report"]},{"url":"https://bugzilla.suse.com/964452","tags":["report"]},{"url":"https://bugzilla.suse.com/964644","tags":["report"]},{"url":"https://bugzilla.suse.com/964746","tags":["report"]},{"url":"https://bugzilla.suse.com/964925","tags":["report"]},{"url":"https://bugzilla.suse.com/964929","tags":["report"]},{"url":"https://bugzilla.suse.com/964947","tags":["report"]},{"url":"https://bugzilla.suse.com/964950","tags":["report"]},{"url":"https://bugzilla.suse.com/965112","tags":["report"]},{"url":"https://bugzilla.suse.com/965156","tags":["report"]},{"url":"https://bugzilla.suse.com/965269","tags":["report"]},{"url":"https://bugzilla.suse.com/967090","tags":["report"]},{"url":"https://bugzilla.suse.com/967101","tags":["report"]},{"url":"https://bugzilla.suse.com/968004","tags":["report"]},{"url":"https://bugzilla.suse.com/969125","tags":["report"]},{"url":"https://bugzilla.suse.com/969126","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4527","tags":["report"]},{"url":"http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html","tags":["report"]},{"url":"http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00399.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2342-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-6399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3471","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4527","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-11-04T21:00:00Z","modified":"2024-08-06T16:45:14.849Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4386","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-11-04T21:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-7hw2-3f8f-grrh","title":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute...","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2022-05-13T01:13:53Z","modified":"2023-02-10T05:06:07Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:00.716708Z"}],"nvd":[{"id":"CVE-2013-4527","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-11-04T21:55:24.453Z","modified":"2026-06-16T23:57:23.67Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"CVE-2013-4527","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-11-04T21:55:24Z","modified":"2026-04-16T06:16:11.187665847Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4527","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-11-04T21:55:24.453Z","modified":"2026-09-01T20:03:18.454552248Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2014-0426","title":"Updated qemu packages fix multiple security vulnerabilities","description":"Updated qemu packages fix security vulnerabilities:\n\nMichael S. Tsirkin discovered that QEMU incorrectly handled vmxnet3 devices.\nA local guest could possibly use this issue to cause a denial of service, or\npossibly execute arbitrary code on the host (CVE-2013-4544).\n\nMultiple integer overflow, input validation, logic error, and buffer\noverflow flaws were discovered in various QEMU block drivers. An attacker\nable to modify a disk image file loaded by a guest could use these flaws to\ncrash the guest, or corrupt QEMU process memory on the host, potentially\nresulting in arbitrary code execution on the host with the privileges of\nthe QEMU process (CVE-2014-0143, CVE-2014-0144, CVE-2014-0145,\nCVE-2014-0147).\n\nA buffer overflow flaw was found in the way the virtio_net_handle_mac()\nfunction of QEMU processed guest requests to update the table of MAC\naddresses. A privileged guest user could use this flaw to corrupt QEMU\nprocess memory on the host, potentially resulting in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2014-0150).\n\nA divide-by-zero flaw was found in the seek_to_sector() function of the\nparallels block driver in QEMU. An attacker able to modify a disk image\nfile loaded by a guest could use this flaw to crash the guest\n(CVE-2014-0142).\n\nA NULL pointer dereference flaw was found in the QCOW2 block driver in\nQEMU. An attacker able to modify a disk image file loaded by a guest could\nuse this flaw to crash the guest (CVE-2014-0146).\n\nIt was found that the block driver for Hyper-V VHDX images did not\ncorrectly calculate BAT (Block Allocation Table) entries due to a missing\nbounds check. An attacker able to modify a disk image file loaded by a\nguest could use this flaw to crash the guest (CVE-2014-0148).\n\nAn out-of-bounds memory access flaw was found in the way QEMU's IDE device\ndriver handled the execution of SMART EXECUTE OFFLINE commands.\nA privileged guest user could use this flaw to corrupt QEMU process memory\non the host, which could potentially result in arbitrary code execution on\nthe host with the privileges of the QEMU process (CVE-2014-2894).\n\nTwo integer overflow flaws were found in the QEMU block driver for QCOW\nversion 1 disk images. A user able to alter the QEMU disk image files\nloaded by a guest could use either of these flaws to corrupt QEMU process\nmemory on the host, which could potentially result in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2014-0222, CVE-2014-0223).\n\nMultiple buffer overflow, input validation, and out-of-bounds write flaws\nwere found in the way the virtio, virtio-net, virtio-scsi, and usb drivers\nof QEMU handled state loading after migration. A user able to alter the\nsavevm data (either on the disk or over the wire during migration) could\nuse either of these flaws to corrupt QEMU process memory on the\n(destination) host, which could potentially result in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2013-4148, CVE-2013-4151, CVE-2013-4535, CVE-2013-4536, CVE-2013-4541,\nCVE-2013-4542, CVE-2013-6399, CVE-2014-0182, CVE-2014-3461).\n\nAn information leak flaw was found in the way QEMU's VGA emulator accessed\nframe buffer memory for high resolution displays. A privileged guest user\ncould use this flaw to leak memory contents of the host to the guest by\nsetting the display to use a high resolution in the guest (CVE-2014-3615).\n\nWhen guest sends udp packet with source port and source addr 0,\nuninitialized socket is picked up when looking for matching and already\ncreated udp sockets, and later passed to sosendto() where NULL pointer\ndereference is hit during so-\u003eslirp-\u003evnetwork_mask.s_addr access\nOnly guests using qemu user networking are affected (CVE-2014-3640).\n","status":"published","published":"2014-10-28T11:33:36Z","modified":"2026-04-16T06:25:24.24898466Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10233-1","title":"qemu-2.6.1-1.5 on GA media","description":"These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:08.968833Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0927","title":"Red Hat Security Advisory: qemu-kvm security and bug fix update","status":"published","published":"2024-09-15T21:49:26Z","modified":"2026-06-28T10:10:53Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1268","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-15T21:49:32Z","modified":"2026-06-28T10:11:26Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2016:0955-1","title":"Security update for xen","description":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-04-05T11:27:02Z","modified":"2026-02-04T03:02:38.951152Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1318-1","title":"Security update for xen","description":"xen was updated to fix 46 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#964644).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n- CVE-2015-8504: VNC: floating point exception (bsc#958493).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-05-17T12:09:35Z","modified":"2026-02-04T04:06:44.76944Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1745-1","title":"Security update for xen","description":"xen was updated to fix 36 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-07-06T05:46:30Z","modified":"2025-05-02T04:03:59.114846Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2013-4527","description":"Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.","status":"published","published":"2014-02-20T00:00:00Z","modified":"2026-02-04T03:04:27.534859Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-2342-1","title":"qemu, qemu-kvm vulnerabilities","description":"Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple\nissues with QEMU state loading after migration. An attacker able to modify\nthe state data could use these issues to cause a denial of service, or\npossibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,\nCVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,\nCVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,\nCVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,\nCVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,\nCVE-2014-3461)\n\nKevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and\nothers discovered multiple issues in the QEMU block drivers. An attacker\nable to modify disk images could use these issues to cause a denial of\nservice, or possibly execute arbitrary code. (CVE-2014-0142, CVE-2014-0143,\nCVE-2014-0144, CVE-2014-0145, CVE-2014-0146, CVE-2014-0147, CVE-2014-0222,\nCVE-2014-0223)\n\nIt was discovered that QEMU incorrectly handled certain PCIe bus hotplug\noperations. A malicious guest could use this issue to crash the QEMU host,\nresulting in a denial of service. (CVE-2014-3471)\n","status":"published","published":"2014-09-08T17:35:27Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}