{"id":"CVE-2015-8345","aliases":["DEBIAN-CVE-2015-8345","DSA-3469-1","DSA-3470-1","DSA-3471-1","EUVD-2015-8229","GHSA-qh5w-h894-x9jx","MGASA-2016-0023","SUSE-SU-2015:2306-1","SUSE-SU-2015:2324-1","SUSE-SU-2015:2326-1","SUSE-SU-2015:2328-1","SUSE-SU-2015:2338-1","SUSE-SU-2016:0010-1","SUSE-SU-2016:0020-1","SUSE-SU-2016:0021-1","SUSE-SU-2016:0459-1","SUSE-SU-2016:0873-1","SUSE-SU-2016:0955-1","SUSE-SU-2016:1318-1","SUSE-SU-2016:1745-1","UBUNTU-CVE-2015-8345","USN-2828-1","openSUSE-SU-2024:10196-1"],"status":"published","title":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of...","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00393,"percentile":0.33717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-11-27T00:00:00Z","modified":"2026-09-09T07:01:49Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.21"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6a+deb7u12"}]}],"versions":["1.1.2+dfsg-6a","1.1.2+dfsg-6a+deb7u1","1.1.2+dfsg-6a+deb7u10","1.1.2+dfsg-6a+deb7u11","1.1.2+dfsg-6a+deb7u2","1.1.2+dfsg-6a+deb7u3","1.1.2+dfsg-6a+deb7u4","1.1.2+dfsg-6a+deb7u5","1.1.2+dfsg-6a+deb7u6","1.1.2+dfsg-6a+deb7u7","1.1.2+dfsg-6a+deb7u7~bpo60+1","1.1.2+dfsg-6a+deb7u8","1.1.2+dfsg-6a+deb7u9"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2+dfsg-6+deb7u12"}]}],"versions":["1.1.2+dfsg-6","1.1.2+dfsg-6+deb7u1","1.1.2+dfsg-6+deb7u10","1.1.2+dfsg-6+deb7u11","1.1.2+dfsg-6+deb7u2","1.1.2+dfsg-6+deb7u3","1.1.2+dfsg-6+deb7u4","1.1.2+dfsg-6+deb7u5","1.1.2+dfsg-6+deb7u6","1.1.2+dfsg-6+deb7u7","1.1.2+dfsg-6+deb7u7~bpo60+1","1.1.2+dfsg-6+deb7u8","1.1.2+dfsg-6+deb7u9"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12+deb8u5a"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12","1:2.1+dfsg-12+deb8u1","1:2.1+dfsg-12+deb8u2","1:2.1+dfsg-12+deb8u3","1:2.1+dfsg-12+deb8u4","1:2.1+dfsg-12+deb8u4~bpo70+1","1:2.1+dfsg-12+deb8u5","1:2.1+dfsg-12+deb8u5a~bpo70+1","1:2.1+dfsg-12~bpo70+1"],"bundled":19},{"source":"osv","ecosystem":"Mageia:5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-2.11.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6_08-23.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_02-4.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_02-4.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_02-4.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_02-4.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_18-21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_18-21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_18-21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_18-21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_18-21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-22.15.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-22.15.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-22.15.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-22.15.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-29.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-29.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-29.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3_06-29.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-22.19.1"}]}],"bundled":45},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_20-24.9"}]}],"bundled":35},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.21"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.21"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://www.securityfocus.com/bid/77985","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/25/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.debian.org/security/2016/dsa-3469","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3470","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix","report"]},{"url":"http://www.debian.org/security/2016/dsa-3471","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201602-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8345"},{"url":"https://github.com/advisories/GHSA-qh5w-h894-x9jx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8345","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0023.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17260","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152306-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/950703","tags":["report"]},{"url":"https://bugzilla.suse.com/950704","tags":["report"]},{"url":"https://bugzilla.suse.com/950705","tags":["report"]},{"url":"https://bugzilla.suse.com/950706","tags":["report"]},{"url":"https://bugzilla.suse.com/951845","tags":["report"]},{"url":"https://bugzilla.suse.com/953527","tags":["report"]},{"url":"https://bugzilla.suse.com/954405","tags":["report"]},{"url":"https://bugzilla.suse.com/956408","tags":["report"]},{"url":"https://bugzilla.suse.com/956411","tags":["report"]},{"url":"https://bugzilla.suse.com/956832","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152324-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/947165","tags":["report"]},{"url":"https://bugzilla.suse.com/954018","tags":["report"]},{"url":"https://bugzilla.suse.com/956409","tags":["report"]},{"url":"https://bugzilla.suse.com/956592","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152326-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152328-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152338-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/955399","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/947164","tags":["report"]},{"url":"https://bugzilla.suse.com/950590","tags":["report"]},{"url":"https://bugzilla.suse.com/953187","tags":["report"]},{"url":"https://bugzilla.suse.com/956829","tags":["report"]},{"url":"https://bugzilla.suse.com/957162","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160020-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160021-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160459-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/954864","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/897654","tags":["report"]},{"url":"https://bugzilla.suse.com/901508","tags":["report"]},{"url":"https://bugzilla.suse.com/902737","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/928393","tags":["report"]},{"url":"https://bugzilla.suse.com/945404","tags":["report"]},{"url":"https://bugzilla.suse.com/945989","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/957698","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/958007","tags":["report"]},{"url":"https://bugzilla.suse.com/958009","tags":["report"]},{"url":"https://bugzilla.suse.com/958491","tags":["report"]},{"url":"https://bugzilla.suse.com/958523","tags":["report"]},{"url":"https://bugzilla.suse.com/958917","tags":["report"]},{"url":"https://bugzilla.suse.com/959005","tags":["report"]},{"url":"https://bugzilla.suse.com/959332","tags":["report"]},{"url":"https://bugzilla.suse.com/959387","tags":["report"]},{"url":"https://bugzilla.suse.com/959695","tags":["report"]},{"url":"https://bugzilla.suse.com/960334","tags":["report"]},{"url":"https://bugzilla.suse.com/960707","tags":["report"]},{"url":"https://bugzilla.suse.com/960725","tags":["report"]},{"url":"https://bugzilla.suse.com/960835","tags":["report"]},{"url":"https://bugzilla.suse.com/960861","tags":["report"]},{"url":"https://bugzilla.suse.com/960862","tags":["report"]},{"url":"https://bugzilla.suse.com/961332","tags":["report"]},{"url":"https://bugzilla.suse.com/961358","tags":["report"]},{"url":"https://bugzilla.suse.com/961691","tags":["report"]},{"url":"https://bugzilla.suse.com/962320","tags":["report"]},{"url":"https://bugzilla.suse.com/963782","tags":["report"]},{"url":"https://bugzilla.suse.com/963923","tags":["report"]},{"url":"https://bugzilla.suse.com/964413","tags":["report"]},{"url":"https://bugzilla.suse.com/965315","tags":["report"]},{"url":"https://bugzilla.suse.com/965317","tags":["report"]},{"url":"https://bugzilla.suse.com/967012","tags":["report"]},{"url":"https://bugzilla.suse.com/967013","tags":["report"]},{"url":"https://bugzilla.suse.com/967969","tags":["report"]},{"url":"https://bugzilla.suse.com/969121","tags":["report"]},{"url":"https://bugzilla.suse.com/969122","tags":["report"]},{"url":"https://bugzilla.suse.com/969350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/959928","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/958493","tags":["report"]},{"url":"https://bugzilla.suse.com/958918","tags":["report"]},{"url":"https://bugzilla.suse.com/959006","tags":["report"]},{"url":"https://bugzilla.suse.com/960726","tags":["report"]},{"url":"https://bugzilla.suse.com/960836","tags":["report"]},{"url":"https://bugzilla.suse.com/961692","tags":["report"]},{"url":"https://bugzilla.suse.com/962321","tags":["report"]},{"url":"https://bugzilla.suse.com/962335","tags":["report"]},{"url":"https://bugzilla.suse.com/962360","tags":["report"]},{"url":"https://bugzilla.suse.com/962611","tags":["report"]},{"url":"https://bugzilla.suse.com/962627","tags":["report"]},{"url":"https://bugzilla.suse.com/962632","tags":["report"]},{"url":"https://bugzilla.suse.com/962642","tags":["report"]},{"url":"https://bugzilla.suse.com/962758","tags":["report"]},{"url":"https://bugzilla.suse.com/963783","tags":["report"]},{"url":"https://bugzilla.suse.com/964415","tags":["report"]},{"url":"https://bugzilla.suse.com/964431","tags":["report"]},{"url":"https://bugzilla.suse.com/964452","tags":["report"]},{"url":"https://bugzilla.suse.com/964644","tags":["report"]},{"url":"https://bugzilla.suse.com/964746","tags":["report"]},{"url":"https://bugzilla.suse.com/964925","tags":["report"]},{"url":"https://bugzilla.suse.com/964929","tags":["report"]},{"url":"https://bugzilla.suse.com/964947","tags":["report"]},{"url":"https://bugzilla.suse.com/964950","tags":["report"]},{"url":"https://bugzilla.suse.com/965112","tags":["report"]},{"url":"https://bugzilla.suse.com/965156","tags":["report"]},{"url":"https://bugzilla.suse.com/965269","tags":["report"]},{"url":"https://bugzilla.suse.com/967090","tags":["report"]},{"url":"https://bugzilla.suse.com/967101","tags":["report"]},{"url":"https://bugzilla.suse.com/968004","tags":["report"]},{"url":"https://bugzilla.suse.com/969125","tags":["report"]},{"url":"https://bugzilla.suse.com/969126","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8345","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/25/3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2828-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7512","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-8345","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2017-04-13T17:00:00Z","modified":"2024-08-06T08:13:32.275Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-8229","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2017-04-13T17:00:00Z","modified":"2024-08-06T08:13:32Z","updated_at":"2026-11-03T01:57:27.742981Z"}],"ghsa":[{"id":"GHSA-qh5w-h894-x9jx","title":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of...","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2022-05-13T01:12:20Z","modified":"2023-02-01T05:03:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T14:50:06.799159Z"}],"nvd":[{"id":"CVE-2015-8345","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2017-04-13T17:59:00.387Z","modified":"2026-06-17T00:34:21.437Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"CVE-2015-8345","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2017-04-13T17:59:00Z","modified":"2026-04-16T06:21:22.159587777Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8345","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2017-04-13T17:59:00.387Z","modified":"2026-09-09T07:01:49.508701921Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8345","description":"The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.","status":"published","published":"2015-11-27T00:00:00Z","modified":"2026-02-04T03:30:16.04859Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DSA-3469-1","title":"qemu - security update","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-03-09T01:20:40.795867Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3470-1","title":"qemu-kvm - security update","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-03-09T01:20:30.067451Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3471-1","title":"qemu - security update","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-03-09T01:22:50.078645Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0023","title":"Updated qemu packages fix security vulnerabilities","description":"A heap-based buffer overflow flaw was discovered in the way QEMU's AMD\nPC-Net II Ethernet Controller emulation received certain packets in\nloopback mode. A privileged user (with the CAP_SYS_RAWIO capability)\ninside a guest could use this flaw to crash the host QEMU process\n(resulting in denial of service) or, potentially, execute arbitrary code\nwith privileges of the host QEMU process (CVE-2015-7504)\n\nA buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation\nvalidated certain received packets from a remote host in non-loopback mode.\nA remote, unprivileged attacker could potentially use this flaw to execute\narbitrary code on the host with the privileges of the QEMU process. Note\nthat to exploit this flaw, the guest network interface must have a large\nMTU limit (CVE-2015-7512)\n\nA NULL pointer dereference vulnerability was found in the QEMU emulator\nbuilt with PCI MSI-X support. Because MSI-X MMIO support did not define\nthe .write method, when the controller tried to write to the pending bit\narray(PBA) memory region, a segmentation fault occurred. A privileged\nattacker inside the guest could use this flaw to crash the QEMU process\nresulting in denial of service (CVE-2015-7549)\n\nAn infinite-loop flaw was discovered in the QEMU emulator built with i8255x\n(PRO100) emulation support. When processing a chain of commands located in\nthe Command Block List(CBL), each Command Block(CB) points to the next\ncommand in the list. If the link to the next CB pointed to the same block\nor if there was a closed loop in the chain, an infinite loop would execute\nthe same command over and over again. A privileged user inside the guest\ncould use this flaw to crash the QEMU instance, resulting in denial of\nservice (CVE-2015-8345).\n\nAn arithmetic-exception flaw was found in the QEMU emulator built with VNC\ndisplay-driver support. The VNC server incorrectly handled 'SetPixelFormat'\nmessages sent from clients. A privileged remote client could use this flaw\nto crash the guest resulting in denial of service (CVE-2015-8504).\n\nAn infinite-loop issue was found in the QEMU emulator built with USB EHCI\nemulation support. The flaw occurred during communication between the host\ncontroller interface(EHCI) and a respective device driver. These two\ncommunicate using an isochronous transfer descriptor list(iTD). an infinite\nloop unfolded if there was a closed loop in the list. A privileged user\ninside a guest could use this flaw to consume excessive resources and cause\ndenial of service (CVE-2015-8558).\n\nA memory-leak flaw was found in the QEMU emulator built with VMWARE VMXNET3\nparavirtual NIC emulator support. The flaw occurred when a guest repeatedly\ntried to activate the VMXNET3 device. A privileged guest attacker could use\nthis flaw to leak host memory, resulting in denial of service on the host.\n(CVE-2015-8567, CVE-2015-8568)\n\nA stack buffer-overflow vulnerability has been discovered in the QEMU\nemulator built with SCSI MegaRAID SAS HBA emulation support. The flaw occurs\nwhen processing the SCSI controller's CTRL_GET_INFO command. A privileged\nguest user could exploit this flaw to crash the QEMU process instance\n(denial of service). (CVE-2015-8613)\n\nAn out-of-bounds write vulnerability has been found in the QEMU emulator\nbuilt with Human Monitor Interface(HMP) support. The issue occurs when the\n'sendkey' command (in hmp_sendkey) is processed with a 'keyname_len' that is\ngreater than the 'keyname_buf' array size. A user or process could exploit\nthis flaw to crash the QEMU process instance (denial of service).\n(CVE-2015-8619)\n\nQemu emulator built with the Q35 chipset based pc system emulator is\nvulnerable to a heap based buffer overflow. It occurs during VM guest\nmigration, as more(8 bytes) data is moved than allocated memory area. A\nprivileged guest user could use this issue to corrupt the VM guest image,\npotentially leading to a DoS. This issue affects q35 machine types.\n(CVE-2015-8666)\n\nAn out-of-bounds read-write access flaw was found in the QEMU emulator built\nwith NE2000-device emulation support. The flaw occurred while performing\n'ioport' read-write operations. A privileged (CAP_SYS_RAWIO) user or process\ncould exploit the flaw to leak or corrupt QEMU memory bytes (CVE-2015-8743)\n\nA reachable-assertion flaw was found in the QEMU emulator built with VMWARE\nVMXNET3 paravirtualized NIC emulator support. The flaw occurs if a guest\nsends a Layer-2 packet that was smaller than 22 bytes. A privileged\n(CAP_SYS_RAWIO) guest user could exploit this flaw to crash the QEMU\nprocess instance, resulting in denial of service (CVE-2015-8744)\n\nA reachable-assertion flaw was found in the QEMU emulator built with VMWARE\nVMXNET3 paravirtualized NIC emulator support. The flaw could occur while\nreading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest\nuser could exploit this flaw to crash the QEMU process instance, resulting\nin denial of service (CVE-2015-8745)\n\nA user-after-free vulnerability was discovered in the QEMU emulator built\nwith IDE AHCI emulation support. The flaw could occur after processing AHCI\nNative Command Queuing(NCQ) AIO commands. A privileged user inside the guest\ncould use this flaw to crash the QEMU process instance (denial of service)\nor potentially execute arbitrary code on the host with QEMU-process\nprivileges (CVE-2016-1568).\n\nAn out-of-bounds read/write flaw was discovered in the QEMU emulator built\nwith Firmware Configuration device emulation support. The flaw could occur\nwhile processing firmware configurations if the current configuration entry\nvalue was set to be invalid. A privileged(CAP_SYS_RAWIO) user or process\ninside the guest could exploit this flaw to crash the QEMU process instance\n(denial of service), or potentially execute arbitrary code on the host with\nQEMU-process privileges (CVE-2016-1714).\n","status":"published","published":"2016-01-17T00:26:26Z","modified":"2026-04-16T06:22:50.380748971Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:2306-1","title":"Security update for xen","description":"\n\nThis update fixes the following security issues:\n\n- bsc#956832 -  CVE-2015-8345: xen: qemu: net: eepro100:\n  infinite loop in processing command block list\n\n- bsc#956408 -  CVE-2015-8339, CVE-2015-8340: xen:\n  XENMEM_exchange error handling issues (XSA-159)\n  xsa159.patch\n- bsc#956411 -  CVE-2015-7504: xen: heap buffer overflow\n  vulnerability in pcnet emulator (XSA-162)\n\n- bsc#954405 -  CVE-2015-8104: Xen: guest to host DoS by\n  triggering an infinite loop in microcode via #DB exception\n- bsc#953527 -  CVE-2015-5307: kernel: kvm/xen: x86: avoid\n  guest-\u003ehost DOS by intercepting #AC (XSA-156)\n\n- bsc#950704 -  CVE-2015-7970: xen: x86: Long latency\n  populate-on-demand operation is not preemptible (XSA-150)\n\n- bsc#951845 -  CVE-2015-7972: xen: x86: populate-on-demand\n  balloon size inaccuracy can crash guests (XSA-153)\n\n- bsc#950703 -  CVE-2015-7969: xen: leak of main per-domain\n  vcpu pointer array (DoS) (XSA-149)\n- bsc#950705 -  CVE-2015-7969: xen: x86: leak of per-domain\n  profiling-related vcpu pointer array (DoS) (XSA-151)\n- bsc#950706 -  CVE-2015-7971: xen: x86: some pmu and\n  profiling hypercalls log without rate limiting (XSA-152)","status":"published","published":"2015-12-18T17:18:02Z","modified":"2026-02-04T02:37:24.29337Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2324-1","title":"Security update for xen","description":"\n\nThis update fixes the following security issues:\n\n- bsc#956832 -  CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list\n\n- Revert x86/IO-APIC: don't create pIRQ mapping from masked RTE until kernel maintenance release goes out.\n\n- bsc#956592 -  xen: virtual PMU is unsupported (XSA-163)\n\n- bsc#956408 -  CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159)\n\n- bsc#956409 -  CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160)\n\n- bsc#956411 -  CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162)\n\n- bsc#947165 -  CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)\n\n- bsc#954405 -  CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception\n\n- bsc#954018 -  CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156)\n","status":"published","published":"2015-12-19T11:25:39Z","modified":"2026-02-04T03:46:38.891811Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2326-1","title":"Security update for xen","description":"\n\nThis update fixes the following security issues:\n      \n- bsc#956832 -  CVE-2015-8345: xen: qemu: net: eepro100:\n  infinite loop in processing command block list\n\n- bsc#956592 -  xen: virtual PMU is unsupported (XSA-163)\n\n- bsc#956408 -  CVE-2015-8339, CVE-2015-8340: xen:\n  XENMEM_exchange error handling issues (XSA-159)\n\n- bsc#956409 -  CVE-2015-8341: xen: libxl leak of pv kernel\n  and initrd on error (XSA-160)\n\n- bsc#956411 -  CVE-2015-7504: xen: heap buffer overflow\n  vulnerability in pcnet emulator (XSA-162)\n\n- bsc#947165 -  CVE-2015-7311: xen: libxl fails to honour\n  readonly flag on disks with qemu-xen (xsa-142)\n\n- bsc#954405 -  CVE-2015-8104: Xen: guest to host DoS by\n  triggering an infinite loop in microcode via #DB exception\n- bsc#954018 -  CVE-2015-5307: xen: x86: CPU lockup during\n  fault delivery (XSA-156)\n\n- bsc#950704 -  CVE-2015-7970: xen: x86: Long latency\n  populate-on-demand operation is not preemptible (XSA-150)\n\n- bsc#951845 -  CVE-2015-7972: xen: x86: populate-on-demand\n  balloon size inaccuracy can crash guests (XSA-153)\n\n- bsc#950703 -  CVE-2015-7969: xen: leak of main per-domain\n  vcpu pointer array (DoS) (XSA-149)\n- bsc#950705 -  CVE-2015-7969: xen: x86: leak of per-domain\n  profiling-related vcpu pointer array (DoS) (XSA-151)\n- bsc#950706 -  CVE-2015-7971: xen: x86: some pmu and\n  profiling hypercalls log without rate limiting (XSA-152)","status":"published","published":"2015-12-19T11:25:04Z","modified":"2026-02-04T02:58:29.792142Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2328-1","title":"Security update for xen","description":"\n\nThis update fixes the following security issues:\n\n- bsc#956832 -  CVE-2015-8345: xen: qemu: net: eepro100:\n  infinite loop in processing command block list\n\n- bsc#956592 -  xen: virtual PMU is unsupported (XSA-163)\n\n- bsc#956408 -  CVE-2015-8339, CVE-2015-8340: xen:\n  XENMEM_exchange error handling issues (XSA-159)\n\n- bsc#956409 -  CVE-2015-8341: xen: libxl leak of pv kernel\n  and initrd on error (XSA-160)\n\n- bsc#956411 -  CVE-2015-7504: xen: heap buffer overflow\n  vulnerability in pcnet emulator (XSA-162)\n\n- bsc#947165 -  CVE-2015-7311: xen: libxl fails to honour\n  readonly flag on disks with qemu-xen (xsa-142)\n\n- bsc#954405 -  CVE-2015-8104: Xen: guest to host DoS by\n  triggering an infinite loop in microcode via #DB exception\n\n- bsc#954018 -  CVE-2015-5307: xen: x86: CPU lockup during\n  fault delivery (XSA-156)\n  CVE-2015-5307-xsa156.patch\n\n- bsc#950704 -  CVE-2015-7970: xen: x86: Long latency\n  populate-on-demand operation is not preemptible (XSA-150)\n  563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch\n\n- bsc#951845 -  CVE-2015-7972: xen: x86: populate-on-demand\n  balloon size inaccuracy can crash guests (XSA-153)\n  xsa153-libxl.patch\n  xend-xsa153.patch\n- Drop 5604f239-x86-PV-properly-populate-descriptor-tables.patch\n\n- bsc#950703 -  CVE-2015-7969: xen: leak of main per-domain\n  vcpu pointer array (DoS) (XSA-149)\n- bsc#950705 -  CVE-2015-7969: xen: x86: leak of per-domain\n  profiling-related vcpu pointer array (DoS) (XSA-151)\n- bsc#950706 -  CVE-2015-7971: xen: x86: some pmu and\n  profiling hypercalls log without rate limiting (XSA-152)","status":"published","published":"2015-12-19T11:26:05Z","modified":"2026-02-04T03:51:29.495663Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2338-1","title":"Security update for xen","description":"\n      This update fixes the following security issues:\n\n- bsc#955399 -  Fix xm migrate --log_progress.\n  Due to logic error progress was not logged when requested.\n\n- bsc#956832 -  CVE-2015-8345: xen: qemu: net: eepro100:\n  infinite loop in processing command block list\n\n- bsc#956592 -  xen: virtual PMU is unsupported (XSA-163)\n\n- bsc#956408 -  CVE-2015-8339, CVE-2015-8340: xen:\n  XENMEM_exchange error handling issues (XSA-159)\n\n- bsc#956409 -  CVE-2015-8341: xen: libxl leak of pv kernel\n  and initrd on error (XSA-160)\n\n- bsc#956411 -  CVE-2015-7504: xen: heap buffer overflow\n  vulnerability in pcnet emulator (XSA-162)\n\n- bsc#947165 -  CVE-2015-7311: xen: libxl fails to honour\n  readonly flag on disks with qemu-xen (xsa-142)\n\n- bsc#955399 -  Fix xm migrate --live.  The options were not passed\n  due to a merge error. As a result the migration was not live,\n  instead the suspended guest was migrated.\n\n- bsc#954405 -  CVE-2015-8104: Xen: guest to host DoS by\n  triggering an infinite loop in microcode via #DB exception\n\n- bsc#954018 -  CVE-2015-5307: xen: x86: CPU lockup during\n  fault delivery (XSA-156)\n\n\n- bsc#950704 -  CVE-2015-7970: xen: x86: Long latency\n  populate-on-demand operation is not preemptible (XSA-150)\n\n- bsc#951845 -  CVE-2015-7972: xen: x86: populate-on-demand\n  balloon size inaccuracy can crash guests (XSA-153)\n\n- Drop 5604f239-x86-PV-properly-populate-descriptor-tables.patch\n\n- bsc#950703 -  CVE-2015-7969: xen: leak of main per-domain\n  vcpu pointer array (DoS) (XSA-149)\n\n- bsc#950705 -  CVE-2015-7969: xen: x86: leak of per-domain\n  profiling-related vcpu pointer array (DoS) (XSA-151)\n\n- bsc#950706 -  CVE-2015-7971: xen: x86: some pmu and\n  profiling hypercalls log without rate limiting (XSA-152)","status":"published","published":"2015-12-22T08:41:00Z","modified":"2026-02-04T02:16:43.367905Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0010-1","title":"Security update for kvm","description":"\nThis update for kvm fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2015-7512: The receive packet size is now checked in the emulated\n  pcnet driver, eliminating buffer overflow and potential security\n  issue by malicious guest systems. (bsc#957162)\n- CVE-2015-8345: A infinite loop in processing command block list was fixed that could be\n  exploit by malicious guest systems (bsc#956829).\n\nOther bugs fixed:\n- To assist users past the migration incompatibility discussed in\n  bsc#950590 (restore migration compatibility with SLE11 SP3 and\n  SLE12, at the unfortunate expense to prior SLE11 SP4 kvm release\n  compatability when a virtio-net device is used), print a message\n  which references the support document TID 7017048.\n  See https://www.suse.com/support/kb/doc.php?id=7017048\n- Fix cases of wrong clock values in kvmclock timekeeping\n  (bsc#947164 and bsc#953187)\n- Enforce pxe rom sizes to ensure migration compatibility.\n  (bsc#950590)\n- Fix kvm live migration fails between sles11 sp3 and sp4 (bsc#950590)\n","status":"published","published":"2016-01-04T09:22:40Z","modified":"2026-02-04T04:04:46.231001Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0020-1","title":"Security update for kvm","description":"\nThis update for kvm fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2015-7512: The receive packet size is now checked in the emulated\n  pcnet driver, eliminating buffer overflow and potential security\n  issue by malicious guest systems. (bsc#957162)\n- CVE-2015-8345: A infinite loop in processing command block list was fixed that could be\n  exploit by malicious guest systems (bsc#956829).\n\nBugs fixed:\n- Fix cases of wrong clock values in kvmclock timekeeping\n  (bsc#947164 and bsc#953187)\n- Enforce pxe rom sizes to ensure migration compatibility.\n  (bsc#950590)\n","status":"published","published":"2016-01-05T10:46:32Z","modified":"2026-02-04T04:16:45.715409Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0021-1","title":"Security update for qemu","description":"\n\nThis update fixes the following security issues:\n\n- Enforce receive packet size, thus eliminating buffer overflow and\n  potential security issue. (bsc#957162 CVE-2015-7512)\n- Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829):\n\nAlso a non-security bug fixed:\n- Fix cases of wrong clock values in kvmclock timekeeping (bsc#947164 and bsc#953187)\n","status":"published","published":"2016-01-05T10:30:50Z","modified":"2026-02-04T03:21:09.081475Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0459-1","title":"Security update for qemu","description":"\nThis update fixes the following security issues:\n\n- Enforce receive packet size, thus eliminating buffer overflow and\n  potential security issue. (bsc#957162 CVE-2015-7512)\n- Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829):\n\nThis update also fixes a non-security bug:\n- Due to space restrictions in limited bios data areas, don't create\n  mptable if vcpu count is 'high' (ie more than ~19). (bsc#954864)\n  (No supported guests are negatively impacted by this change, which\n  is taken from upstream seabios)\n","status":"published","published":"2016-02-15T14:28:30Z","modified":"2026-02-04T03:06:38.377705Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0873-1","title":"Security update for xen","description":"xen was updated to fix 44 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#957698: DOM0 can't bring up on Dell PC\n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-03-24T08:10:03Z","modified":"2025-05-02T04:03:59.176752Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0955-1","title":"Security update for xen","description":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-04-05T11:27:02Z","modified":"2026-02-04T03:02:38.951152Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1318-1","title":"Security update for xen","description":"xen was updated to fix 46 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#964644).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n- CVE-2015-8504: VNC: floating point exception (bsc#958493).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-05-17T12:09:35Z","modified":"2026-02-04T04:06:44.76944Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1745-1","title":"Security update for xen","description":"xen was updated to fix 36 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-07-06T05:46:30Z","modified":"2025-05-02T04:03:59.114846Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2828-1","title":"qemu, qemu-kvm vulnerabilities","description":"Jason Wang discovered that QEMU incorrectly handled the virtio-net device.\nA remote attacker could use this issue to cause guest network consumption,\nresulting in a denial of service. (CVE-2015-7295)\n\nQinghao Tang and Ling Liu discovered that QEMU incorrectly handled the\npcnet driver when used in loopback mode. A malicious guest could use this\nissue to cause a denial of service, or possibly execute arbitrary code on\nthe host as the user running the QEMU process. In the default installation,\nwhen QEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2015-7504)\n\nLing Liu and Jason Wang discovered that QEMU incorrectly handled the\npcnet driver. A remote attacker could use this issue to cause a denial of\nservice, or possibly execute arbitrary code on the host as the user running\nthe QEMU process. In the default installation, when QEMU is used with\nlibvirt, attackers would be isolated by the libvirt AppArmor profile.\n(CVE-2015-7512)\n\nQinghao Tang discovered that QEMU incorrectly handled the eepro100 driver.\nA malicious guest could use this issue to cause an infinite loop, leading\nto a denial of service. (CVE-2015-8345)\n","status":"published","published":"2015-12-03T12:34:36Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}