{"id":"CVE-2014-5263","aliases":["BELL-CVE-2014-5263","DEBIAN-CVE-2014-5263","EUVD-2014-5156","GHSA-qxm2-g26p-5vjg","MGASA-2014-0467","UBUNTU-CVE-2014-5263","USN-2409-1"],"status":"published","title":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the...","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01567,"percentile":0.75471,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-08-26T00:00:00Z","modified":"2026-10-23T15:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.5.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"usbredir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"],"bundled":6}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/08/04/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1126543","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3afca1d6d413592c2b78cf28f52fa24a586d8f56","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/08/16/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2409-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5263"},{"url":"http://git.qemu.org/?p=qemu.git;a=commitdiff;h=3afca1d6d413592c2b78cf28f52fa24a586d8f56"},{"url":"https://github.com/advisories/GHSA-qxm2-g26p-5vjg"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-5263","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5263","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0467.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14434","tags":["report"]},{"url":"http://advisories.mageia.org/MGASA-2014-0426.html","tags":["advisory"]},{"url":"https://www.debian.org/security/2014/dsa-3066","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2409-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/143312.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-5263","tags":["report"]},{"url":"http://seclists.org/oss-sec/2014/q3/285","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2409-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7815","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5263","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T11:41:48.49Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5156","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-qxm2-g26p-5vjg","title":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the...","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2022-05-17T04:21:28Z","modified":"2025-04-12T12:37:56Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-5263","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T14:55:06.08Z","modified":"2026-06-17T00:11:17.9Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"BELL-CVE-2014-5263","title":"CVE-2014-5263 does not affect BellSoft software","status":"withdrawn","published":"2014-08-26T14:55:00Z","modified":"2026-01-28T07:21:24.699946Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-5263","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T14:55:06Z","modified":"2026-04-16T06:22:38.315221205Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5263","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T14:55:06.08Z","modified":"2026-10-23T15:47:39.055196423Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0467","title":"Updated qemu packages fix security vulnerabilities","description":"The Advanced Threat Research team at Intel Security reported that guest\nprovided parameter were insufficiently validated in rectangle functions in\nthe vmware-vga driver. A privileged guest user could use this flaw to write\ninto qemu address space on the host, potentially escalating their privileges\nto those of the qemu host process (CVE-2014-3689).\n\nIt was discovered that QEMU incorrectly handled USB xHCI controller live\nmigration. An attacker could possibly use this issue to cause a denial of\nservice, or possibly execute arbitrary code (CVE-2014-5263).\n\nJames Spadaro of Cisco reported insufficiently sanitized bits_per_pixel from\nthe client in the QEMU VNC display driver. An attacker having access to the\nguest's VNC console could use this flaw to crash the guest (CVE-2014-7815).\n\nAdditionally, the qemu update in MGASA-2014-0426 did not have USB redirection\nsupport because Qemu 1.6.2 requires an updated libusbredirparser library.\nThis update has been built against the updated usbredirparser library.\n","status":"published","published":"2014-11-21T12:44:16Z","modified":"2026-04-16T06:22:24.432354834Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-5263","description":"vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.","status":"published","published":"2014-08-26T00:00:00Z","modified":"2026-02-04T02:59:59.229483Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2409-1","title":"qemu, qemu-kvm vulnerabilities","description":"Laszlo Ersek discovered that QEMU incorrectly handled memory in the vga\ndevice. A malicious guest could possibly use this issue to read arbitrary\nhost memory. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10.\n(CVE-2014-3615)\n\nXavier Mehrenberger and Stephane Duverger discovered that QEMU incorrectly\nhandled certain udp packets when using guest networking. A malicious guest\ncould possibly use this issue to cause a denial of service. (CVE-2014-3640)\n\nIt was discovered that QEMU incorrectly handled parameter validation in\nthe vmware_vga device. A malicious guest could possibly use this issue to\nwrite into memory of the host, leading to privilege escalation.\n(CVE-2014-3689)\n\nIt was discovered that QEMU incorrectly handled USB xHCI controller live\nmigration. An attacker could possibly use this issue to cause a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-5263)\n\nMichael S. Tsirkin discovered that QEMU incorrectly handled memory in the\nACPI PCI hotplug interface. A malicious guest could possibly use this issue\nto access memory of the host, leading to information disclosure or\nprivilege escalation. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-5388)\n\nJames Spadaro discovered that QEMU incorrectly handled certain VNC\nbytes_per_pixel values. An attacker having access to a VNC console could\npossibly use this issue to cause a guest to crash, resulting in a denial of\nservice. (CVE-2014-7815)\n","status":"published","published":"2014-11-13T12:54:29Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}