{"id":"CVE-2014-7815","aliases":["DEBIAN-CVE-2014-7815","DSA-3066-1","DSA-3067-1","EUVD-2014-7684","GHSA-5gvx-32vr-xx6v","MGASA-2014-0467","RHSA-2015:0349","RHSA-2015:0624","SUSE-SU-2015:1782-1","SUSE-SU-2016:0873-1","SUSE-SU-2016:0955-1","SUSE-SU-2016:1154-1","SUSE-SU-2016:1318-1","SUSE-SU-2016:1745-1","SUSE-SU-2016:2628-1","UBUNTU-CVE-2014-7815","USN-2409-1","openSUSE-SU-2024:10196-1"],"status":"published","title":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of...","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03742,"percentile":0.89921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-10-29T00:00:00Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["2.1+dfsg-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["2.1+dfsg-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["2.1+dfsg-7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-7"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6a+deb7u5"}]}],"versions":["1.1.2+dfsg-6a","1.1.2+dfsg-6a+deb7u1","1.1.2+dfsg-6a+deb7u2","1.1.2+dfsg-6a+deb7u3","1.1.2+dfsg-6a+deb7u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6+deb7u5"}]}],"versions":["1.1.2+dfsg-6","1.1.2+dfsg-6+deb7u1","1.1.2+dfsg-6+deb7u2","1.1.2+dfsg-6+deb7u3","1.1.2+dfsg-6+deb7u4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.5.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"usbredir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6_08-26.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_20-24.9"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-47.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-47.1"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.7"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"virtualization"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://secunia.com/advisories/61484","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0624.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/62144","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157641","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/62143","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0349.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3067","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://support.citrix.com/article/CTX200892","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2409-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3066","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7815","tags":["advisory"]},{"url":"http://git.qemu.org/?p=qemu.git;a=commit;h=e6908bfe8e07f2b452e78e677da1b45b1c0f6829"},{"url":"https://github.com/advisories/GHSA-5gvx-32vr-xx6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-7815","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0467.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14434","tags":["report"]},{"url":"http://advisories.mageia.org/MGASA-2014-0426.html","tags":["advisory"]},{"url":"https://www.debian.org/security/2014/dsa-3066","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2409-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/143312.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0349","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Virtualization_Deployment_and_Administration_Guide/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=895436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=949385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=990724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1002493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1017685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1021788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1027565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1054077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1075846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1079147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088150","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1088822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1089606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1095645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1098602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1111450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1118707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1142290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1155518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1175325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180942","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0349.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7815","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8106","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0624","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=733600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=760898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=801284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=852348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=893654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=946993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1003432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1024599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1047748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1055532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1061827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071058","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1083844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1093023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1121025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1126777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1128608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1132569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1133736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1138579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1142331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1145042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1147354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1150820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1151947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1153590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1172473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1175841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182494","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0624.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151782-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/902737","tags":["report"]},{"url":"https://bugzilla.suse.com/928308","tags":["report"]},{"url":"https://bugzilla.suse.com/934506","tags":["report"]},{"url":"https://bugzilla.suse.com/934517","tags":["report"]},{"url":"https://bugzilla.suse.com/936537","tags":["report"]},{"url":"https://bugzilla.suse.com/937125","tags":["report"]},{"url":"https://bugzilla.suse.com/937572","tags":["report"]},{"url":"https://bugzilla.suse.com/938344","tags":["report"]},{"url":"https://bugzilla.suse.com/939216","tags":["report"]},{"url":"https://bugzilla.suse.com/943446","tags":["report"]},{"url":"https://bugzilla.suse.com/944017","tags":["report"]},{"url":"https://bugzilla.suse.com/945404","tags":["report"]},{"url":"https://bugzilla.suse.com/945778","tags":["report"]},{"url":"https://bugzilla.suse.com/945987","tags":["report"]},{"url":"https://bugzilla.suse.com/945989","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/897654","tags":["report"]},{"url":"https://bugzilla.suse.com/901508","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/928393","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/956829","tags":["report"]},{"url":"https://bugzilla.suse.com/957162","tags":["report"]},{"url":"https://bugzilla.suse.com/957698","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/958007","tags":["report"]},{"url":"https://bugzilla.suse.com/958009","tags":["report"]},{"url":"https://bugzilla.suse.com/958491","tags":["report"]},{"url":"https://bugzilla.suse.com/958523","tags":["report"]},{"url":"https://bugzilla.suse.com/958917","tags":["report"]},{"url":"https://bugzilla.suse.com/959005","tags":["report"]},{"url":"https://bugzilla.suse.com/959332","tags":["report"]},{"url":"https://bugzilla.suse.com/959387","tags":["report"]},{"url":"https://bugzilla.suse.com/959695","tags":["report"]},{"url":"https://bugzilla.suse.com/960334","tags":["report"]},{"url":"https://bugzilla.suse.com/960707","tags":["report"]},{"url":"https://bugzilla.suse.com/960725","tags":["report"]},{"url":"https://bugzilla.suse.com/960835","tags":["report"]},{"url":"https://bugzilla.suse.com/960861","tags":["report"]},{"url":"https://bugzilla.suse.com/960862","tags":["report"]},{"url":"https://bugzilla.suse.com/961332","tags":["report"]},{"url":"https://bugzilla.suse.com/961358","tags":["report"]},{"url":"https://bugzilla.suse.com/961691","tags":["report"]},{"url":"https://bugzilla.suse.com/962320","tags":["report"]},{"url":"https://bugzilla.suse.com/963782","tags":["report"]},{"url":"https://bugzilla.suse.com/963923","tags":["report"]},{"url":"https://bugzilla.suse.com/964413","tags":["report"]},{"url":"https://bugzilla.suse.com/965315","tags":["report"]},{"url":"https://bugzilla.suse.com/965317","tags":["report"]},{"url":"https://bugzilla.suse.com/967012","tags":["report"]},{"url":"https://bugzilla.suse.com/967013","tags":["report"]},{"url":"https://bugzilla.suse.com/967969","tags":["report"]},{"url":"https://bugzilla.suse.com/969121","tags":["report"]},{"url":"https://bugzilla.suse.com/969122","tags":["report"]},{"url":"https://bugzilla.suse.com/969350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/959928","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161154-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/956832","tags":["report"]},{"url":"https://bugzilla.suse.com/958493","tags":["report"]},{"url":"https://bugzilla.suse.com/958918","tags":["report"]},{"url":"https://bugzilla.suse.com/959006","tags":["report"]},{"url":"https://bugzilla.suse.com/960726","tags":["report"]},{"url":"https://bugzilla.suse.com/960836","tags":["report"]},{"url":"https://bugzilla.suse.com/961692","tags":["report"]},{"url":"https://bugzilla.suse.com/962321","tags":["report"]},{"url":"https://bugzilla.suse.com/962335","tags":["report"]},{"url":"https://bugzilla.suse.com/962360","tags":["report"]},{"url":"https://bugzilla.suse.com/962611","tags":["report"]},{"url":"https://bugzilla.suse.com/962627","tags":["report"]},{"url":"https://bugzilla.suse.com/962632","tags":["report"]},{"url":"https://bugzilla.suse.com/962642","tags":["report"]},{"url":"https://bugzilla.suse.com/962758","tags":["report"]},{"url":"https://bugzilla.suse.com/963783","tags":["report"]},{"url":"https://bugzilla.suse.com/964415","tags":["report"]},{"url":"https://bugzilla.suse.com/964431","tags":["report"]},{"url":"https://bugzilla.suse.com/964452","tags":["report"]},{"url":"https://bugzilla.suse.com/964644","tags":["report"]},{"url":"https://bugzilla.suse.com/964746","tags":["report"]},{"url":"https://bugzilla.suse.com/964925","tags":["report"]},{"url":"https://bugzilla.suse.com/964929","tags":["report"]},{"url":"https://bugzilla.suse.com/964947","tags":["report"]},{"url":"https://bugzilla.suse.com/964950","tags":["report"]},{"url":"https://bugzilla.suse.com/965112","tags":["report"]},{"url":"https://bugzilla.suse.com/965156","tags":["report"]},{"url":"https://bugzilla.suse.com/965269","tags":["report"]},{"url":"https://bugzilla.suse.com/967090","tags":["report"]},{"url":"https://bugzilla.suse.com/967101","tags":["report"]},{"url":"https://bugzilla.suse.com/968004","tags":["report"]},{"url":"https://bugzilla.suse.com/969125","tags":["report"]},{"url":"https://bugzilla.suse.com/969126","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/944697","tags":["report"]},{"url":"https://bugzilla.suse.com/982017","tags":["report"]},{"url":"https://bugzilla.suse.com/982018","tags":["report"]},{"url":"https://bugzilla.suse.com/982019","tags":["report"]},{"url":"https://bugzilla.suse.com/982222","tags":["report"]},{"url":"https://bugzilla.suse.com/982223","tags":["report"]},{"url":"https://bugzilla.suse.com/982285","tags":["report"]},{"url":"https://bugzilla.suse.com/982959","tags":["report"]},{"url":"https://bugzilla.suse.com/983961","tags":["report"]},{"url":"https://bugzilla.suse.com/983982","tags":["report"]},{"url":"https://bugzilla.suse.com/991080","tags":["report"]},{"url":"https://bugzilla.suse.com/991466","tags":["report"]},{"url":"https://bugzilla.suse.com/996441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7116","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-7815","tags":["report"]},{"url":"http://lists.gnu.org/archive/html/qemu-devel/2014-10/msg03210.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2409-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5388","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-7815","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-11-14T15:00:00Z","modified":"2024-08-06T13:03:27.297Z","updated_at":"2026-11-02T14:33:46.955592Z"}],"euvd":[{"id":"EUVD-2014-7684","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-11-14T15:00:00Z","modified":"2024-08-06T13:03:27Z","updated_at":"2026-11-03T01:56:53.794428Z"}],"ghsa":[{"id":"GHSA-5gvx-32vr-xx6v","title":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of...","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2022-05-13T01:23:55Z","modified":"2023-02-20T05:05:48Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:11.398505Z"}],"nvd":[{"id":"CVE-2014-7815","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-11-14T15:59:01.497Z","modified":"2026-06-17T00:15:44.607Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-7815","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-11-14T15:59:01Z","modified":"2026-04-16T06:16:58.039109444Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-7815","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-11-14T15:59:01.497Z","modified":"2026-10-23T15:47:36.511404864Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-3066-1","title":"qemu - security update","status":"published","published":"2014-11-06T00:00:00Z","modified":"2026-03-09T01:22:21.830331Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3067-1","title":"qemu-kvm - security update","status":"published","published":"2014-11-06T00:00:00Z","modified":"2026-03-09T01:18:37.187579Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0467","title":"Updated qemu packages fix security vulnerabilities","description":"The Advanced Threat Research team at Intel Security reported that guest\nprovided parameter were insufficiently validated in rectangle functions in\nthe vmware-vga driver. A privileged guest user could use this flaw to write\ninto qemu address space on the host, potentially escalating their privileges\nto those of the qemu host process (CVE-2014-3689).\n\nIt was discovered that QEMU incorrectly handled USB xHCI controller live\nmigration. An attacker could possibly use this issue to cause a denial of\nservice, or possibly execute arbitrary code (CVE-2014-5263).\n\nJames Spadaro of Cisco reported insufficiently sanitized bits_per_pixel from\nthe client in the QEMU VNC display driver. An attacker having access to the\nguest's VNC console could use this flaw to crash the guest (CVE-2014-7815).\n\nAdditionally, the qemu update in MGASA-2014-0426 did not have USB redirection\nsupport because Qemu 1.6.2 requires an updated libusbredirparser library.\nThis update has been built against the updated usbredirparser library.\n","status":"published","published":"2014-11-21T12:44:16Z","modified":"2026-04-16T06:22:24.432354834Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:0349","title":"Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update","status":"published","published":"2024-09-13T09:22:21Z","modified":"2026-06-29T10:08:36Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0624","title":"Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update","status":"published","published":"2024-09-13T09:22:28Z","modified":"2026-06-29T10:08:36Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:1782-1","title":"Security update for qemu","description":"qemu was updated to fix several security issues and bugs.\n\nThe following vulnerabilities were fixed:\n- CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU,\n  when the container has a CDROM drive enabled, allows local guest users\n  to execute arbitrary code on the host via unspecified ATAPI commands.\n  (bsc#938344).\n- CVE-2015-5278: QEMU was vulnerable to an infinite loop issue that\n  could occur when receiving packets over the network. (bsc#945989)\n- CVE-2015-5279: QEMU was vulnerable to a heap buffer overflow issue\n  that could occur when receiving packets over the network. (bsc#945987)\n- CVE-2015-6855: QEMU was vulnerable to a divide by zero issue that could\n  occur while executing an IDE command WIN_READ_NATIVE_MAX to determine\n  the maximum size of a drive. (bsc#945404)\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU\n  allowed remote attackers to cause a denial of service (crash) via a small\n  bytes_per_pixel value.  (bsc#902737):\n\nAlso these non-security issues were fixed:\n- bsc#937572: Fixed dictzip on big endian systems \n- bsc#934517: Fix 'info tlb' causes guest to freeze\n- bsc#934506: Fix vte monitor consol looks empy\n- bsc#937125: Fix parsing of scsi-disk wwn uint64 property \n- bsc#945778: Drop .probe hooks for DictZip and tar block drivers\n- bsc#937572: Fold common-obj-y -\u003e block-obj-y change into original patches\n- bsc#928308,bsc#944017: Fix virtio-ccw index errors when initrd gets too large \n- bsc#936537: Fix possible qemu-img error when converting to compressed qcow2 image\n- bsc#939216: Fix reboot fail after install using uefi\n- bsc#943446: qemu-img convert doesn't create MB aligned VHDs anymore\n\n","status":"published","published":"2015-09-28T09:38:55Z","modified":"2026-02-04T03:44:30.77728Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0873-1","title":"Security update for xen","description":"xen was updated to fix 44 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#957698: DOM0 can't bring up on Dell PC\n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-03-24T08:10:03Z","modified":"2025-05-02T04:03:59.176752Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0955-1","title":"Security update for xen","description":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-04-05T11:27:02Z","modified":"2026-02-04T03:02:38.951152Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1154-1","title":"Security update for xen","description":"xen was updated to fix 27 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThis non-security issue was fixed:\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n","status":"published","published":"2016-04-26T10:49:46Z","modified":"2026-02-04T02:48:01.272314Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1318-1","title":"Security update for xen","description":"xen was updated to fix 46 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#964644).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n- CVE-2015-8504: VNC: floating point exception (bsc#958493).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-05-17T12:09:35Z","modified":"2026-02-04T04:06:44.76944Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1745-1","title":"Security update for xen","description":"xen was updated to fix 36 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-07-06T05:46:30Z","modified":"2025-05-02T04:03:59.114846Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2628-1","title":"Security update for kvm","description":"kvm was updated to fix 16 security issues.\n\nThese security issues were fixed:\n- CVE-2015-6815: e1000 NIC emulation support was vulnerable to an infinite loop issue. A privileged user inside guest could have used this flaw to crash the Qemu instance resulting in DoS.  (bsc#944697).\n- CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers (bsc#967013).\n- CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU did not properly validate USB configuration descriptor objects, which allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet (bsc#967012).\n- CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982223).\n- CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982222).\n- CVE-2016-5105: The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, used an uninitialized variable, which allowed local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982017).\n- CVE-2016-5106: The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982018).\n- CVE-2016-5107: The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors (bsc#982019).\n- CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982285).\n- CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982959).\n- CVE-2016-5337: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983961).\n- CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983982).\n- CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (bsc#991080).\n- CVE-2016-6490: Infinite loop in the virtio framework. A privileged user inside the guest could have used this flaw to crash the Qemu instance on the host resulting in DoS (bsc#991466).\n- CVE-2016-7116: Host directory sharing via Plan 9 File System(9pfs) was vulnerable to a directory/path traversal issue. A privileged user inside guest could have used this flaw to access undue files on the host (bsc#996441).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n","status":"published","published":"2016-10-25T14:22:27Z","modified":"2026-02-04T03:23:39.087469Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2014-7815","description":"The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.","status":"published","published":"2014-10-29T00:00:00Z","modified":"2026-02-04T04:20:35.600416Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2409-1","title":"qemu, qemu-kvm vulnerabilities","description":"Laszlo Ersek discovered that QEMU incorrectly handled memory in the vga\ndevice. A malicious guest could possibly use this issue to read arbitrary\nhost memory. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10.\n(CVE-2014-3615)\n\nXavier Mehrenberger and Stephane Duverger discovered that QEMU incorrectly\nhandled certain udp packets when using guest networking. A malicious guest\ncould possibly use this issue to cause a denial of service. (CVE-2014-3640)\n\nIt was discovered that QEMU incorrectly handled parameter validation in\nthe vmware_vga device. A malicious guest could possibly use this issue to\nwrite into memory of the host, leading to privilege escalation.\n(CVE-2014-3689)\n\nIt was discovered that QEMU incorrectly handled USB xHCI controller live\nmigration. An attacker could possibly use this issue to cause a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS. (CVE-2014-5263)\n\nMichael S. Tsirkin discovered that QEMU incorrectly handled memory in the\nACPI PCI hotplug interface. A malicious guest could possibly use this issue\nto access memory of the host, leading to information disclosure or\nprivilege escalation. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-5388)\n\nJames Spadaro discovered that QEMU incorrectly handled certain VNC\nbytes_per_pixel values. An attacker having access to a VNC console could\npossibly use this issue to cause a guest to crash, resulting in a denial of\nservice. (CVE-2014-7815)\n","status":"published","published":"2014-11-13T12:54:29Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}