{"id":"CVE-2018-16847","aliases":["DEBIAN-CVE-2018-16847","EUVD-2018-8643","GHSA-pxrw-p8g9-545p","SUSE-SU-2018:3927-1","SUSE-SU-2018:4086-1","SUSE-SU-2018:4185-1","UBUNTU-CVE-2018-16847","USN-3826-1"],"status":"published","title":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It...","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00542,"percentile":0.45827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2018-11-02T00:00:00Z","modified":"2026-10-24T10:31:00Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"qemu","fixed_in":["2.11.2-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"qemu","fixed_in":["2.11.2-9.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.12.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.12.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.8"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.44"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.33"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.8"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7"],"bundled":10}],"products":[{"vendor":"[unknown]","product":"qemu:"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"qemu","product":"qemu"},{"vendor":"red hat","product":"qemu:"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16847","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.openwall.com/lists/oss-security/2018/11/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg00200.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3826-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/105866","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16847"},{"url":"https://github.com/advisories/GHSA-pxrw-p8g9-545p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16847","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183927-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1106222","tags":["report"]},{"url":"https://bugzilla.suse.com/1107489","tags":["report"]},{"url":"https://bugzilla.suse.com/1110910","tags":["report"]},{"url":"https://bugzilla.suse.com/1111006","tags":["report"]},{"url":"https://bugzilla.suse.com/1111010","tags":["report"]},{"url":"https://bugzilla.suse.com/1111013","tags":["report"]},{"url":"https://bugzilla.suse.com/1112499","tags":["report"]},{"url":"https://bugzilla.suse.com/1114422","tags":["report"]},{"url":"https://bugzilla.suse.com/1114529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18849","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184086-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1108474","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184185-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16847","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3826-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19364","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-16847","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T22:00:00Z","modified":"2024-08-05T10:32:54.125Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8643","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T22:00:00Z","modified":"2024-08-05T10:32:54Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-pxrw-p8g9-545p","title":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It...","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2022-05-13T01:26:34Z","modified":"2023-02-01T05:07:46Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:36.63783Z"}],"nvd":[{"id":"CVE-2018-16847","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T22:29:00.347Z","modified":"2026-06-17T01:44:54.06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787","CWE-125"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"CVE-2018-16847","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T22:29:00.347Z","modified":"2026-10-24T10:31:00.009728944Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16847","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T22:29:00.347Z","modified":"2026-10-23T18:03:01.210374298Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-16847","description":"An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.","status":"published","published":"2018-11-02T00:00:00Z","modified":"2026-02-04T03:24:37.173862Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"SUSE-SU-2018:3927-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910).\n- CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222).\n- CVE-2018-16847: Fixed an OOB heap buffer r/w access issue that was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process (bsc#1114529).\n- CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006).\n- CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010).\n- CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013)\n- CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422).\n\nNon-security issues fixed:\n\n- Fix slowness in arm32 emulation (bsc#1112499).\n- In order to improve spectre mitigation for s390x, add a new feature in the QEMU cpu model to provide the etoken cpu feature for guests (bsc#1107489).\n","status":"published","published":"2018-11-27T12:39:22Z","modified":"2026-02-04T02:44:58.127896Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:4086-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-16847: Fixed an out of bounds r/w buffer access in cmb operations (bsc#1114529).\n\nNon-security issue fixed:\n\n- Fixed serial console issue in SLES 12 SP2 that triggered a qemu-kvm bug (bsc#1108474).\n","status":"published","published":"2018-12-12T08:20:05Z","modified":"2026-02-04T03:00:46.051107Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:4185-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910).\n- CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222).\n- CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006).\n- CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010).\n- CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013)\n- CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422).\n- CVE-2018-16847: Fixed an out of bounds r/w buffer access in cmb operations (bsc#1114529).\n\nNon-security issue fixed:\n\n- Fixed a condition when retry logic does not have been executed in case of data transmit failure or connection hungup (bsc#1108474).\n","status":"published","published":"2018-12-19T10:32:26Z","modified":"2026-02-04T02:18:46.77585Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3826-1","title":"qemu vulnerabilities","description":"Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nNE2000 device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-10839)\n\nIt was discovered that QEMU incorrectly handled the Slirp networking\nback-end. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code on the host. In the default installation, when QEMU is used\nwith libvirt, attackers would be isolated by the libvirt AppArmor profile.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS. (CVE-2018-11806)\n\nFakhri Zulkifli discovered that the QEMU guest agent incorrectly handled\ncertain QMP commands. An attacker could possibly use this issue to crash\nthe QEMU guest agent, resulting in a denial of service. (CVE-2018-12617)\n\nLi Qiang discovered that QEMU incorrectly handled NVM Express Controller\nemulation. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode on the host. In the default installation, when QEMU is used with\nlibvirt, attackers would be isolated by the libvirt AppArmor profile. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16847)\n\nDaniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nRTL8139 device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-17958)\n\nDaniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nPCNET device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-17962)\n\nDaniel Shapira discovered that QEMU incorrectly handled large packet sizes.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2018-17963)\n\nIt was discovered that QEMU incorrectly handled LSI53C895A device\nemulation. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2018-18849)\n\nMoguofang discovered that QEMU incorrectly handled the IPowerNV LPC\ncontroller. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 18.10. (CVE-2018-18954)\n\nZhibin Hu discovered that QEMU incorrectly handled the Plan 9 File System\nsupport. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2018-19364)\n","status":"published","published":"2018-11-26T14:23:51Z","modified":"2026-05-04T09:38:36.737045Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}