{"id":"CVE-2016-2841","aliases":["DEBIAN-CVE-2016-2841","DLA-1599-1","EUVD-2016-3914","GHSA-fvfw-92qr-62hm","MGASA-2016-0176","SUSE-SU-2016:0873-1","SUSE-SU-2016:0955-1","SUSE-SU-2016:1154-1","SUSE-SU-2016:1560-1","SUSE-SU-2016:1698-1","SUSE-SU-2016:1703-1","SUSE-SU-2016:1745-1","SUSE-SU-2016:1785-1","UBUNTU-CVE-2016-2841","USN-2974-1","openSUSE-SU-2024:10196-1"],"status":"published","title":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before...","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","severity":{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00391,"percentile":0.33496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-03-04T00:00:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12+deb8u8"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12","1:2.1+dfsg-12+deb8u1","1:2.1+dfsg-12+deb8u2","1:2.1+dfsg-12+deb8u3","1:2.1+dfsg-12+deb8u4","1:2.1+dfsg-12+deb8u4~bpo70+1","1:2.1+dfsg-12+deb8u5","1:2.1+dfsg-12+deb8u5a","1:2.1+dfsg-12+deb8u5a~bpo70+1","1:2.1+dfsg-12+deb8u6","1:2.1+dfsg-12+deb8u7","1:2.1+dfsg-12~bpo70+1"],"bundled":47},{"source":"osv","ecosystem":"Mageia:5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2_06-7.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_02-32.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6_08-26.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.19.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.19.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.19.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-46.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-46.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-14.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-14.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-14.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_20-24.9"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-44.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-44.1"}]}],"bundled":33},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.24"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.1"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.24"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.1"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/03/02/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303106","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/84028","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201609-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg06126.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2974-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2841"},{"url":"http://git.qemu.org/?p=qemu.git;a=commit;h=415ab35a441eca767d033a2702223e785b9d5190"},{"url":"https://github.com/advisories/GHSA-fvfw-92qr-62hm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2841","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17534","tags":["report"]},{"url":"http://wiki.qemu.org/ChangeLog/2.2","tags":["web"]},{"url":"http://wiki.qemu.org/ChangeLog/2.3","tags":["web"]},{"url":"http://wiki.qemu.org/ChangeLog/2.4","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1283934","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2891-1/","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2974-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/897654","tags":["report"]},{"url":"https://bugzilla.suse.com/901508","tags":["report"]},{"url":"https://bugzilla.suse.com/902737","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/928393","tags":["report"]},{"url":"https://bugzilla.suse.com/945404","tags":["report"]},{"url":"https://bugzilla.suse.com/945989","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/956829","tags":["report"]},{"url":"https://bugzilla.suse.com/957162","tags":["report"]},{"url":"https://bugzilla.suse.com/957698","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/958007","tags":["report"]},{"url":"https://bugzilla.suse.com/958009","tags":["report"]},{"url":"https://bugzilla.suse.com/958491","tags":["report"]},{"url":"https://bugzilla.suse.com/958523","tags":["report"]},{"url":"https://bugzilla.suse.com/958917","tags":["report"]},{"url":"https://bugzilla.suse.com/959005","tags":["report"]},{"url":"https://bugzilla.suse.com/959332","tags":["report"]},{"url":"https://bugzilla.suse.com/959387","tags":["report"]},{"url":"https://bugzilla.suse.com/959695","tags":["report"]},{"url":"https://bugzilla.suse.com/960334","tags":["report"]},{"url":"https://bugzilla.suse.com/960707","tags":["report"]},{"url":"https://bugzilla.suse.com/960725","tags":["report"]},{"url":"https://bugzilla.suse.com/960835","tags":["report"]},{"url":"https://bugzilla.suse.com/960861","tags":["report"]},{"url":"https://bugzilla.suse.com/960862","tags":["report"]},{"url":"https://bugzilla.suse.com/961332","tags":["report"]},{"url":"https://bugzilla.suse.com/961358","tags":["report"]},{"url":"https://bugzilla.suse.com/961691","tags":["report"]},{"url":"https://bugzilla.suse.com/962320","tags":["report"]},{"url":"https://bugzilla.suse.com/963782","tags":["report"]},{"url":"https://bugzilla.suse.com/963923","tags":["report"]},{"url":"https://bugzilla.suse.com/964413","tags":["report"]},{"url":"https://bugzilla.suse.com/965315","tags":["report"]},{"url":"https://bugzilla.suse.com/965317","tags":["report"]},{"url":"https://bugzilla.suse.com/967012","tags":["report"]},{"url":"https://bugzilla.suse.com/967013","tags":["report"]},{"url":"https://bugzilla.suse.com/967969","tags":["report"]},{"url":"https://bugzilla.suse.com/969121","tags":["report"]},{"url":"https://bugzilla.suse.com/969122","tags":["report"]},{"url":"https://bugzilla.suse.com/969350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160955-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/959928","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161154-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161560-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/886378","tags":["report"]},{"url":"https://bugzilla.suse.com/895528","tags":["report"]},{"url":"https://bugzilla.suse.com/934069","tags":["report"]},{"url":"https://bugzilla.suse.com/940929","tags":["report"]},{"url":"https://bugzilla.suse.com/944463","tags":["report"]},{"url":"https://bugzilla.suse.com/947159","tags":["report"]},{"url":"https://bugzilla.suse.com/959386","tags":["report"]},{"url":"https://bugzilla.suse.com/960708","tags":["report"]},{"url":"https://bugzilla.suse.com/961333","tags":["report"]},{"url":"https://bugzilla.suse.com/961556","tags":["report"]},{"url":"https://bugzilla.suse.com/970036","tags":["report"]},{"url":"https://bugzilla.suse.com/970037","tags":["report"]},{"url":"https://bugzilla.suse.com/975128","tags":["report"]},{"url":"https://bugzilla.suse.com/975136","tags":["report"]},{"url":"https://bugzilla.suse.com/975700","tags":["report"]},{"url":"https://bugzilla.suse.com/976109","tags":["report"]},{"url":"https://bugzilla.suse.com/978158","tags":["report"]},{"url":"https://bugzilla.suse.com/978160","tags":["report"]},{"url":"https://bugzilla.suse.com/980711","tags":["report"]},{"url":"https://bugzilla.suse.com/980723","tags":["report"]},{"url":"https://bugzilla.suse.com/981266","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4952","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161698-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/936132","tags":["report"]},{"url":"https://bugzilla.suse.com/945987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5279","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/964411","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2197","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161745-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161785-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2841","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2974-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4037","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2841","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-06-16T18:00:00Z","modified":"2024-08-05T23:32:21.295Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-3914","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-06-16T18:00:00Z","modified":"2024-08-05T23:32:21Z","updated_at":"2026-11-03T02:22:52.199729Z"}],"ghsa":[{"id":"GHSA-fvfw-92qr-62hm","title":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before...","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2022-05-14T01:54:30Z","modified":"2023-02-13T00:31:12Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2016-2841","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-06-16T18:59:07.203Z","modified":"2026-06-17T00:44:34.197Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-2841","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-06-16T18:59:07.203Z","modified":"2026-10-24T10:30:27.277192711Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2841","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-06-16T18:59:07.203Z","modified":"2026-09-22T07:03:04.953054606Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2841","description":"The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.","status":"published","published":"2016-03-04T00:00:00Z","modified":"2026-02-04T02:15:59.784375Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-1599-1","title":"qemu - security update","status":"published","published":"2018-11-29T00:00:00Z","modified":"2026-03-09T01:18:54.561467Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2016-0176","title":"Updated qemu packages fix security vulnerabilities","description":"Updated qemu packages fix security vulnerabilities:\n\nAn out-of-bounds flaw was found in the QEMU emulator built using\n'address_space_translate' to map an address to a MemoryRegionSection. The\nflaw could occur while doing pci_dma_read/write calls, resulting in an\nout-of-bounds read-write access error. A privileged user inside a guest could\nuse this flaw to crash the guest instance (denial of service) (CVE-2015-8817,\nCVE-2015-8818).\n\nA NULL-pointer dereference flaw was found in the QEMU emulator built with TPR\noptimization for 32-bit Windows guests support. The flaw occurs when doing\nI/O-port write operations from the HMP interface. The 'current_cpu' value\nremains null because it is not called from the cpu_exec() loop, and\ndereferencing it results in the flaw. An attacker with access to the HMP\ninterface could use this flaw to crash the QEMU instance (denial of service)\n(CVE-2016-1922).\n\nIt was discovered that QEMU incorrectly handled the e1000 device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service (CVE-2016-1981).\n\nZuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI emulation. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service (CVE-2016-2197).\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB EHCI emulation. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service (CVE-2016-2198).\n\nZuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service (CVE-2016-2391).\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service (CVE-2016-2392).\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly leak\nhost memory bytes (CVE-2016-2538).\n\nHongke Yang discovered that QEMU incorrectly handled NE2000 emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service (CVE-2016-2841).\n\nLing Liu discovered that QEMU incorrectly handled IP checksum routines. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly leak host memory bytes\n(CVE-2016-2857).\n\nIt was discovered that QEMU incorrectly handled the PRNG back-end support.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service (CVE-2016-2858).\n\nWei Xiao and Qinghao Tang discovered that QEMU incorrectly handled access\nin the VGA module. A privileged attacker inside the guest could use this\nissue to cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when QEMU\nis used with libvirt, attackers would be isolated by the libvirt AppArmor\nprofile (CVE-2016-3710).\n\nZuozhi Fzz discovered that QEMU incorrectly handled access in the VGA\nmodule. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when QEMU\nis used with libvirt, attackers would be isolated by the libvirt AppArmor\nprofile (CVE-2016-3712).\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary\nMicro Stellaris ethernet controller emulation. A remote attacker could use\nthis issue to cause QEMU to crash, resulting in a denial of service\n(CVE-2016-4001).\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet\ncontroller emulation. A remote attacker could use this issue to cause QEMU\nto crash, resulting in a denial of service (CVE-2016-4002).\n\nDonghai Zdh discovered that QEMU incorrectly handled the Task Priority\nRegister(TPR). A privileged attacker inside the guest could use this issue\nto possibly leak host memory bytes (CVE-2016-4020).\n\nDu Shaobo discovered that QEMU incorrectly handled USB EHCI emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to consume resources, resulting in a denial of service\n(CVE-2016-4037).\n\nThe qemu package has been updated to version 2.4.1 and patched to fix these\nissues.\n","status":"published","published":"2016-05-18T20:14:22Z","modified":"2026-04-16T06:24:31.660709406Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:0873-1","title":"Security update for xen","description":"xen was updated to fix 44 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#957698: DOM0 can't bring up on Dell PC\n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated\n- bsc#959695: Missing docs for xen\n","status":"published","published":"2016-03-24T08:10:03Z","modified":"2025-05-02T04:03:59.176752Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0955-1","title":"Security update for xen","description":"xen was updated to fix 47 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969121).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969122).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-04-05T11:27:02Z","modified":"2026-02-04T03:02:38.951152Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1154-1","title":"Security update for xen","description":"xen was updated to fix 27 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThis non-security issue was fixed:\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n","status":"published","published":"2016-04-26T10:49:46Z","modified":"2026-02-04T02:48:01.272314Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1560-1","title":"Security update for qemu","description":"qemu was updated to fix 37 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n- CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121)\n- CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n- CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed\n- bsc#886378: qemu truncates vhd images in virt-rescue\n","status":"published","published":"2016-06-13T07:13:18Z","modified":"2026-02-04T03:44:42.289772Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1698-1","title":"Security update for kvm","description":"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109) \n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed:\n- Fix case of IDE interface needing busy status set before flush (bsc#936132)\n","status":"published","published":"2016-06-28T14:31:01Z","modified":"2026-02-04T03:07:16.951102Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1703-1","title":"Security update for qemu","description":"qemu was updated to fix 29 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266)\n- CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121)\n- CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB engine (bsc#964411)\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n- CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835).\n- CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed\n- bsc#886378: qemu truncates vhd images in virt-rescue\n","status":"published","published":"2016-06-29T05:47:55Z","modified":"2026-02-04T04:36:14.909397Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1745-1","title":"Security update for xen","description":"xen was updated to fix 36 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#864655).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829).\n- CVE-2015-8504: VNC: floating point exception (bsc#958491).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969).\n- CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#959695: Missing docs for xen\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend\n- bsc#959928: When DomU is in state running xm domstate returned nothing\n","status":"published","published":"2016-07-06T05:46:30Z","modified":"2025-05-02T04:03:59.114846Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1785-1","title":"Security update for kvm","description":"kvm was updated to fix 33 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711)\n- CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723)\n- CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158)\n- CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160)\n- CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)\n- CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969)\n- CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350)\n- CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036)\n- CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037)\n- CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128)\n- CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136)\n- CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700)\n- CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069)\n- CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393)\n- CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508)\n- CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528).\n- CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).\n- CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987).\n- CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929).\n- CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404).\n- CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159).\n- CVE-2015-7549: PCI null pointer dereferences (bsc#958917).\n- CVE-2015-8504: VNC floating point exception (bsc#958491).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005).\n- CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358).\n- CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334).\n- CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725).\n- CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332).\n- CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691).\n- CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320).\n- CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782).\n- CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413).\n\nThis non-security issue was fixed:\n- Fix case of IDE interface needing busy status set before flush (bsc#936132)\n","status":"published","published":"2016-07-11T11:31:17Z","modified":"2026-02-04T04:04:29.51983Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2974-1","title":"qemu, qemu-kvm vulnerabilities","description":"Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2391)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2392)\n\nQinghao Tang discovered that QEMU incorrectly handled USB Net emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly leak\nhost memory bytes. (CVE-2016-2538)\n\nHongke Yang discovered that QEMU incorrectly handled NE2000 emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2016-2841)\n\nLing Liu discovered that QEMU incorrectly handled IP checksum routines. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly leak host memory bytes.\n(CVE-2016-2857)\n\nIt was discovered that QEMU incorrectly handled the PRNG back-end support.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only applied to Ubuntu 14.04\nLTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-2858)\n\nWei Xiao and Qinghao Tang discovered that QEMU incorrectly handled access\nin the VGA module. A privileged attacker inside the guest could use this\nissue to cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when QEMU\nis used with libvirt, attackers would be isolated by the libvirt AppArmor\nprofile. (CVE-2016-3710)\n\nZuozhi Fzz discovered that QEMU incorrectly handled access in the VGA\nmodule. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code on the host. In the default installation, when QEMU\nis used with libvirt, attackers would be isolated by the libvirt AppArmor\nprofile. (CVE-2016-3712)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled Luminary\nMicro Stellaris ethernet controller emulation. A remote attacker could use\nthis issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-4001)\n\nOleksandr Bazhaniuk discovered that QEMU incorrectly handled MIPSnet\ncontroller emulation. A remote attacker could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2016-4002)\n\nDonghai Zdh discovered that QEMU incorrectly handled the Task Priority\nRegister(TPR). A privileged attacker inside the guest could use this issue\nto possibly leak host memory bytes. This issue only applied to Ubuntu 14.04\nLTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4020)\n\nDu Shaobo discovered that QEMU incorrectly handled USB EHCI emulation\nsupport. A privileged attacker inside the guest could use this issue to\ncause QEMU to consume resources, resulting in a denial of service.\n(CVE-2016-4037)\n","status":"published","published":"2016-05-12T14:33:38Z","modified":"2026-02-10T04:40:59Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}