{"id":"CVE-2014-3640","aliases":["DEBIAN-CVE-2014-3640","DSA-3044-1","DSA-3045-1","EUVD-2014-3598","GHSA-j3fm-c8x4-hh72","MGASA-2014-0426","RHSA-2015:0349","RHSA-2015:0624","SUSE-SU-2015:0357-1","SUSE-SU-2016:0873-1","SUSE-SU-2016:0955-1","SUSE-SU-2016:1154-1","SUSE-SU-2016:1318-1","SUSE-SU-2016:1745-1","UBUNTU-CVE-2014-3640","USN-2409-1","openSUSE-SU-2024:10196-1"],"status":"published","title":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of...","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00405,"percentile":0.34985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2014-10-04T00:00:00Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["2.1+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["2.1+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["2.1+dfsg-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6+deb7u4"}]}],"versions":["1.1.2+dfsg-6","1.1.2+dfsg-6+deb7u1","1.1.2+dfsg-6+deb7u2","1.1.2+dfsg-6+deb7u3"],"bundled":10},{"source":"osv","ecosystem":"Debian:7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6a+deb7u4"}]}],"versions":["1.1.2+dfsg-6a","1.1.2+dfsg-6a+deb7u1","1.1.2+dfsg-6a+deb7u2","1.1.2+dfsg-6a+deb7u3"],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.2.mga4"}]}],"bundled":34},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6_08-26.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_20-24.9"}]}],"bundled":35},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-3045","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144818","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0624.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0349.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3044","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2409-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3640","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0349","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0624","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3640","tags":["report"]},{"url":"https://github.com/advisories/GHSA-j3fm-c8x4-hh72"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3640","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0426.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13096","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137578.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/140130.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0420.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0704.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0743.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1669.html","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2182-1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Virtualization_Deployment_and_Administration_Guide/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=895436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=949385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=990724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1002493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1017685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1021788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1027565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1054077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1075846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1079147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088150","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1089606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1095645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1111450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1142290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1155518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1175325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180942","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0349.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3640","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7815","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8106","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=733600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=760898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=801284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=852348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=893654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=946993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1003432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1024599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1047748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1055532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1061827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071058","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1121025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1126777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1133736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1142331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1145042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1147354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1150820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1151947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1153590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1172473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1175841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182494","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0624.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150357-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/843074","tags":["report"]},{"url":"https://bugzilla.suse.com/852397","tags":["report"]},{"url":"https://bugzilla.suse.com/878350","tags":["report"]},{"url":"https://bugzilla.suse.com/879665","tags":["report"]},{"url":"https://bugzilla.suse.com/897654","tags":["report"]},{"url":"https://bugzilla.suse.com/897783","tags":["report"]},{"url":"https://bugzilla.suse.com/899144","tags":["report"]},{"url":"https://bugzilla.suse.com/899484","tags":["report"]},{"url":"https://bugzilla.suse.com/900084","tags":["report"]},{"url":"https://bugzilla.suse.com/904176","tags":["report"]},{"url":"https://bugzilla.suse.com/905097","tags":["report"]},{"url":"https://bugzilla.suse.com/907805","tags":["report"]},{"url":"https://bugzilla.suse.com/908381","tags":["report"]},{"url":"https://bugzilla.suse.com/910145","tags":["report"]},{"url":"https://bugzilla.suse.com/911742","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8106","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/901508","tags":["report"]},{"url":"https://bugzilla.suse.com/902737","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/928393","tags":["report"]},{"url":"https://bugzilla.suse.com/945404","tags":["report"]},{"url":"https://bugzilla.suse.com/945989","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/956829","tags":["report"]},{"url":"https://bugzilla.suse.com/957162","tags":["report"]},{"url":"https://bugzilla.suse.com/957698","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/958007","tags":["report"]},{"url":"https://bugzilla.suse.com/958009","tags":["report"]},{"url":"https://bugzilla.suse.com/958491","tags":["report"]},{"url":"https://bugzilla.suse.com/958523","tags":["report"]},{"url":"https://bugzilla.suse.com/958917","tags":["report"]},{"url":"https://bugzilla.suse.com/959005","tags":["report"]},{"url":"https://bugzilla.suse.com/959332","tags":["report"]},{"url":"https://bugzilla.suse.com/959387","tags":["report"]},{"url":"https://bugzilla.suse.com/959695","tags":["report"]},{"url":"https://bugzilla.suse.com/960334","tags":["report"]},{"url":"https://bugzilla.suse.com/960707","tags":["report"]},{"url":"https://bugzilla.suse.com/960725","tags":["report"]},{"url":"https://bugzilla.suse.com/960835","tags":["report"]},{"url":"https://bugzilla.suse.com/960861","tags":["report"]},{"url":"https://bugzilla.suse.com/960862","tags":["report"]},{"url":"https://bugzilla.suse.com/961332","tags":["report"]},{"url":"https://bugzilla.suse.com/961358","tags":["report"]},{"url":"https://bugzilla.suse.com/961691","tags":["report"]},{"url":"https://bugzilla.suse.com/962320","tags":["report"]},{"url":"https://bugzilla.suse.com/963782","tags":["report"]},{"url":"https://bugzilla.suse.com/963923","tags":["report"]},{"url":"https://bugzilla.suse.com/964413","tags":["report"]},{"url":"https://bugzilla.suse.com/965315","tags":["report"]},{"url":"https://bugzilla.suse.com/965317","tags":["report"]},{"url":"https://bugzilla.suse.com/967012","tags":["report"]},{"url":"https://bugzilla.suse.com/967013","tags":["report"]},{"url":"https://bugzilla.suse.com/967969","tags":["report"]},{"url":"https://bugzilla.suse.com/969121","tags":["report"]},{"url":"https://bugzilla.suse.com/969122","tags":["report"]},{"url":"https://bugzilla.suse.com/969350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/959928","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161154-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/956832","tags":["report"]},{"url":"https://bugzilla.suse.com/958493","tags":["report"]},{"url":"https://bugzilla.suse.com/958918","tags":["report"]},{"url":"https://bugzilla.suse.com/959006","tags":["report"]},{"url":"https://bugzilla.suse.com/960726","tags":["report"]},{"url":"https://bugzilla.suse.com/960836","tags":["report"]},{"url":"https://bugzilla.suse.com/961692","tags":["report"]},{"url":"https://bugzilla.suse.com/962321","tags":["report"]},{"url":"https://bugzilla.suse.com/962335","tags":["report"]},{"url":"https://bugzilla.suse.com/962360","tags":["report"]},{"url":"https://bugzilla.suse.com/962611","tags":["report"]},{"url":"https://bugzilla.suse.com/962627","tags":["report"]},{"url":"https://bugzilla.suse.com/962632","tags":["report"]},{"url":"https://bugzilla.suse.com/962642","tags":["report"]},{"url":"https://bugzilla.suse.com/962758","tags":["report"]},{"url":"https://bugzilla.suse.com/963783","tags":["report"]},{"url":"https://bugzilla.suse.com/964415","tags":["report"]},{"url":"https://bugzilla.suse.com/964431","tags":["report"]},{"url":"https://bugzilla.suse.com/964452","tags":["report"]},{"url":"https://bugzilla.suse.com/964644","tags":["report"]},{"url":"https://bugzilla.suse.com/964746","tags":["report"]},{"url":"https://bugzilla.suse.com/964925","tags":["report"]},{"url":"https://bugzilla.suse.com/964929","tags":["report"]},{"url":"https://bugzilla.suse.com/964947","tags":["report"]},{"url":"https://bugzilla.suse.com/964950","tags":["report"]},{"url":"https://bugzilla.suse.com/965112","tags":["report"]},{"url":"https://bugzilla.suse.com/965156","tags":["report"]},{"url":"https://bugzilla.suse.com/965269","tags":["report"]},{"url":"https://bugzilla.suse.com/967090","tags":["report"]},{"url":"https://bugzilla.suse.com/967101","tags":["report"]},{"url":"https://bugzilla.suse.com/968004","tags":["report"]},{"url":"https://bugzilla.suse.com/969125","tags":["report"]},{"url":"https://bugzilla.suse.com/969126","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3640","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2409-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7815","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3640","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T19:00:00Z","modified":"2024-08-06T10:50:18.275Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3598","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T19:00:00Z","modified":"2024-08-06T10:50:18Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-j3fm-c8x4-hh72","title":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of...","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2022-05-17T00:28:35Z","modified":"2023-02-10T05:07:16Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2014-3640","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T19:55:02.713Z","modified":"2026-06-17T00:08:40.303Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-3640","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T19:55:02Z","modified":"2026-04-16T06:19:23.250767509Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3640","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T19:55:02.713Z","modified":"2026-10-23T15:47:36.554328351Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-3044-1","title":"qemu-kvm - security update","status":"published","published":"2014-10-04T00:00:00Z","modified":"2026-03-09T01:17:58.489273Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3045-1","title":"qemu - security update","status":"published","published":"2014-10-04T00:00:00Z","modified":"2026-03-09T01:19:57.418971Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0426","title":"Updated qemu packages fix multiple security vulnerabilities","description":"Updated qemu packages fix security vulnerabilities:\n\nMichael S. Tsirkin discovered that QEMU incorrectly handled vmxnet3 devices.\nA local guest could possibly use this issue to cause a denial of service, or\npossibly execute arbitrary code on the host (CVE-2013-4544).\n\nMultiple integer overflow, input validation, logic error, and buffer\noverflow flaws were discovered in various QEMU block drivers. An attacker\nable to modify a disk image file loaded by a guest could use these flaws to\ncrash the guest, or corrupt QEMU process memory on the host, potentially\nresulting in arbitrary code execution on the host with the privileges of\nthe QEMU process (CVE-2014-0143, CVE-2014-0144, CVE-2014-0145,\nCVE-2014-0147).\n\nA buffer overflow flaw was found in the way the virtio_net_handle_mac()\nfunction of QEMU processed guest requests to update the table of MAC\naddresses. A privileged guest user could use this flaw to corrupt QEMU\nprocess memory on the host, potentially resulting in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2014-0150).\n\nA divide-by-zero flaw was found in the seek_to_sector() function of the\nparallels block driver in QEMU. An attacker able to modify a disk image\nfile loaded by a guest could use this flaw to crash the guest\n(CVE-2014-0142).\n\nA NULL pointer dereference flaw was found in the QCOW2 block driver in\nQEMU. An attacker able to modify a disk image file loaded by a guest could\nuse this flaw to crash the guest (CVE-2014-0146).\n\nIt was found that the block driver for Hyper-V VHDX images did not\ncorrectly calculate BAT (Block Allocation Table) entries due to a missing\nbounds check. An attacker able to modify a disk image file loaded by a\nguest could use this flaw to crash the guest (CVE-2014-0148).\n\nAn out-of-bounds memory access flaw was found in the way QEMU's IDE device\ndriver handled the execution of SMART EXECUTE OFFLINE commands.\nA privileged guest user could use this flaw to corrupt QEMU process memory\non the host, which could potentially result in arbitrary code execution on\nthe host with the privileges of the QEMU process (CVE-2014-2894).\n\nTwo integer overflow flaws were found in the QEMU block driver for QCOW\nversion 1 disk images. A user able to alter the QEMU disk image files\nloaded by a guest could use either of these flaws to corrupt QEMU process\nmemory on the host, which could potentially result in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2014-0222, CVE-2014-0223).\n\nMultiple buffer overflow, input validation, and out-of-bounds write flaws\nwere found in the way the virtio, virtio-net, virtio-scsi, and usb drivers\nof QEMU handled state loading after migration. A user able to alter the\nsavevm data (either on the disk or over the wire during migration) could\nuse either of these flaws to corrupt QEMU process memory on the\n(destination) host, which could potentially result in arbitrary code\nexecution on the host with the privileges of the QEMU process\n(CVE-2013-4148, CVE-2013-4151, CVE-2013-4535, CVE-2013-4536, CVE-2013-4541,\nCVE-2013-4542, CVE-2013-6399, CVE-2014-0182, CVE-2014-3461).\n\nAn information leak flaw was found in the way QEMU's VGA emulator accessed\nframe buffer memory for high resolution displays. A privileged guest user\ncould use this flaw to leak memory contents of the host to the guest by\nsetting the display to use a high resolution in the guest (CVE-2014-3615).\n\nWhen guest sends udp packet with source port and source addr 0,\nuninitialized socket is picked up when looking for matching and already\ncreated udp sockets, and later passed to sosendto() where NULL pointer\ndereference is hit during so-\u003eslirp-\u003evnetwork_mask.s_addr access\nOnly guests using qemu user networking are affected (CVE-2014-3640).\n","status":"published","published":"2014-10-28T11:33:36Z","modified":"2026-04-16T06:25:24.24898466Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:0349","title":"Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update","status":"published","published":"2024-09-13T09:22:21Z","modified":"2026-06-29T10:08:36Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0624","title":"Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update","status":"published","published":"2024-09-13T09:22:28Z","modified":"2026-06-29T10:08:36Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0357-1","title":"Security update for kvm and libvirt","description":"\nThis collective update for KVM and libvirt provides fixes for security and \nnon-security issues.\n\nkvm:\n\n    * Fix NULL pointer dereference because of uninitialized UDP socket.\n      (bsc#897654, CVE-2014-3640)\n    * Fix performance degradation after migration. (bsc#878350)\n    * Fix potential image corruption due to missing FIEMAP_FLAG_SYNC flag\n      in FS_IOC_FIEMAP ioctl. (bsc#908381)\n    * Add validate hex properties for qdev. (bsc#852397)\n    * Add boot option to do strict boot (bsc#900084)\n    * Add query-command-line-options QMP command. (bsc#899144)\n    * Fix incorrect return value of migrate_cancel. (bsc#843074)\n    * Fix insufficient parameter validation during ram load. (bsc#905097,\n      CVE-2014-7840)\n    * Fix insufficient blit region checks in qemu/cirrus. (bsc#907805,\n      CVE-2014-8106)\n\nlibvirt:\n\n    * Fix security hole with migratable flag in dumpxml. (bsc#904176,\n      CVE-2014-7823)\n    * Fix domain deadlock. (bsc#899484, CVE-2014-3657)\n    * Use correct definition when looking up disk in qemu blkiotune.\n      (bsc#897783, CVE-2014-3633)\n    * Fix undefined symbol when starting virtlockd. (bsc#910145)\n    * Add '-boot strict' to qemu's commandline whenever possible.\n      (bsc#900084)\n    * Add support for 'reboot-timeout' in qemu. (bsc#899144)\n    * Increase QEMU's monitor timeout to 30sec. (bsc#911742)\n    * Allow setting QEMU's migration max downtime any time. (bsc#879665)\n\nSecurity Issues:\n\n    * CVE-2014-7823\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7823\u003e\n    * CVE-2014-3657\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3657\u003e\n    * CVE-2014-3633\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3633\u003e\n    * CVE-2014-3640\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640\u003e\n    * CVE-2014-7840\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7840\u003e\n    * CVE-2014-8106\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8106\u003e\n\n","status":"published","published":"2015-01-23T01:22:37Z","modified":"2026-02-04T04:33:51.683598Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2016:0873-1","title":"Security update for xen","description":"xen was updated to fix 44 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#957698: DOM0 can't bring up on Dell PC\n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-03-24T08:10:03Z","modified":"2025-05-02T04:03:59.176752Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0955-1","title":"Security update for xen","description":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-04-05T11:27:02Z","modified":"2026-02-04T03:02:38.951152Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1154-1","title":"Security update for xen","description":"xen was updated to fix 27 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThis non-security issue was fixed:\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n","status":"published","published":"2016-04-26T10:49:46Z","modified":"2026-02-04T02:48:01.272314Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1318-1","title":"Security update for xen","description":"xen was updated to fix 46 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#964644).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n- CVE-2015-8504: VNC: floating point exception (bsc#958493).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-05-17T12:09:35Z","modified":"2026-02-04T04:06:44.76944Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1745-1","title":"Security update for xen","description":"xen was updated to fix 36 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-07-06T05:46:30Z","modified":"2025-05-02T04:03:59.114846Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2014-3640","description":"The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.","status":"published","published":"2014-11-07T00:00:00Z","modified":"2026-02-04T03:44:04.086318Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2409-1","title":"qemu, qemu-kvm vulnerabilities","description":"Laszlo Ersek discovered that QEMU incorrectly handled memory in the vga\ndevice. A malicious guest could possibly use this issue to read arbitrary\nhost memory. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10.\n(CVE-2014-3615)\n\nXavier Mehrenberger and Stephane Duverger discovered that QEMU incorrectly\nhandled certain udp packets when using guest networking. A malicious guest\ncould possibly use this issue to cause a denial of service. (CVE-2014-3640)\n\nIt was discovered that QEMU incorrectly handled parameter validation in\nthe vmware_vga device. A malicious guest could possibly use this issue to\nwrite into memory of the host, leading to privilege escalation.\n(CVE-2014-3689)\n\nIt was discovered that QEMU incorrectly handled USB xHCI controller live\nmigration. An attacker could possibly use this issue to cause a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-5263)\n\nMichael S. Tsirkin discovered that QEMU incorrectly handled memory in the\nACPI PCI hotplug interface. A malicious guest could possibly use this issue\nto access memory of the host, leading to information disclosure or\nprivilege escalation. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-5388)\n\nJames Spadaro discovered that QEMU incorrectly handled certain VNC\nbytes_per_pixel values. An attacker having access to a VNC console could\npossibly use this issue to cause a guest to crash, resulting in a denial of\nservice. (CVE-2014-7815)\n","status":"published","published":"2014-11-13T12:54:29Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}