{"id":"CVE-2018-7858","aliases":["DEBIAN-CVE-2018-7858","EUVD-2018-19570","GHSA-f62g-jrwm-hq59","RHSA-2018:1369","RHSA-2018:1416","RHSA-2018:1643","RHSA-2018:1644","RHSA-2018:1645","RHSA-2018:1646","RHSA-2018:2162","SUSE-SU-2019:0489-1","SUSE-SU-2019:0582-1","UBUNTU-CVE-2018-7858","USN-3649-1","openSUSE-SU-2024:11287-1"],"status":"published","title":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows...","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0061,"percentile":0.49449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-03-12T00:00:00Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.12~rc3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.12~rc3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.12~rc3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-156.el7_5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.12~rc3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.12~rc3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.12~rc3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-156.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:12::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.10.0-21.el7_5.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.506.el6_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.1"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.41"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.28"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.1"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-32.1"}]}],"bundled":135}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2162","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553402","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1369","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3649-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1416","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/103350","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2018/03/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2018-03/msg02174.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Release Notes","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7858","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f62g-jrwm-hq59"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-7858","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1555213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566587","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1369.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7550","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7858","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1416.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1643","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/ssbd","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566890","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1643.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3639","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3639","tags":["advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1528","tags":["article"]},{"url":"https://software.intel.com/sites/default/files/managed/b9/f9/336983-Intel-Analysis-of-Speculative-Execution-Side-Channels-White-Paper.pdf","tags":["article"]},{"url":"https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf","tags":["article"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1644","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1644.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1645","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1645.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1646","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1646.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1486560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1530356","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2162.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-13672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5683","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5683","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190489-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084604","tags":["report"]},{"url":"https://bugzilla.suse.com/1113231","tags":["report"]},{"url":"https://bugzilla.suse.com/1116717","tags":["report"]},{"url":"https://bugzilla.suse.com/1117275","tags":["report"]},{"url":"https://bugzilla.suse.com/1119493","tags":["report"]},{"url":"https://bugzilla.suse.com/1123156","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190582-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056334","tags":["report"]},{"url":"https://bugzilla.suse.com/1056386","tags":["report"]},{"url":"https://bugzilla.suse.com/1114957","tags":["report"]},{"url":"https://bugzilla.suse.com/1121600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18954","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-7858","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3649-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-16845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7550","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-03812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3682","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-7858","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T21:00:00Z","modified":"2024-08-05T06:37:59.526Z","updated_at":"2026-11-02T14:35:09.908186Z"}],"euvd":[{"id":"EUVD-2018-19570","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T21:00:00Z","modified":"2024-08-05T06:37:59Z","updated_at":"2026-11-03T02:40:04.680788Z"}],"ghsa":[{"id":"GHSA-f62g-jrwm-hq59","title":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows...","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2022-05-13T01:13:40Z","modified":"2023-02-01T05:04:11Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:07.876412Z"}],"nvd":[{"id":"CVE-2018-7858","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T21:29:01.267Z","modified":"2026-06-17T02:03:52.71Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-7858","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T21:29:01.267Z","modified":"2026-10-24T10:31:04.803784806Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-7858","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T21:29:01.267Z","modified":"2026-10-23T18:03:09.187374146Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2018:1369","title":"Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update","status":"published","published":"2024-09-13T19:48:12Z","modified":"2026-06-29T10:20:08Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1416","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-13T19:48:18Z","modified":"2026-06-29T10:20:09Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1643","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-29T17:15:51Z","modified":"2026-06-29T10:20:29Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1644","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-29T17:15:57Z","modified":"2026-06-29T10:20:29Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1645","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-29T17:16:03Z","modified":"2026-06-29T10:20:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1646","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-29T17:16:09Z","modified":"2026-06-29T10:20:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:2162","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-29T17:19:25Z","modified":"2026-06-29T10:21:16Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-7858","description":"Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.","status":"published","published":"2018-03-12T00:00:00Z","modified":"2026-02-04T02:34:10.07742Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"openSUSE-SU-2024:11287-1","title":"qemu-6.1.0-32.1 on GA media","description":"These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:57.481645Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0489-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n- CVE-2018-7858: Fixed a denial of service which could occur while updating the VGA display, after guest has adjusted the display dimensions (bsc#1084604).\n- CVE-2017-13673: Fixed a denial of service in the cpu_physical_memory_snapshot_get_dirty function.\n- CVE-2017-13672: Fixed a denial of service via vectors involving display update.\n\nNon-security issues fixed:\n\n- Fixed bad guest time after migration (bsc#1113231).\n","status":"published","published":"2019-02-26T07:40:31Z","modified":"2026-02-04T03:59:44.996909Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0582-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6778: Fixed an out-of-bounds access in slirp (bsc#1123156)\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493)\n- CVE-2018-19489: Fixed a Denial-of-Service in virtfs (bsc#1117275)\n- CVE-2018-19364: Fixed an use-after-free vulnerability if virtfs interface is deliberately abused (bsc#1116717)\n- CVE-2018-18954: Fixed an out-of-bounds access performing PowerNV memory operations (bsc#1114957)\n- CVE-2017-13673: Fixed a reachable assert failure during during display update (bsc#1056386)\n- CVE-2017-13672: Fixed an out-of-bounds read access during display update (bsc#1056334)\n- CVE-2018-7858: Fixed an out-of-bounds access in cirrus when updating vga display allowing for Denial-of-Service (bsc#1084604)\n\nOther bug fixes and changes:\n\n- Fix pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600)\n- Fix bad guest time after migration (bsc#1113231)\n","status":"published","published":"2019-03-11T17:34:20Z","modified":"2025-05-02T04:06:23.528007Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3649-1","title":"qemu vulnerabilities","description":"Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values\nduring migration. An attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 18.04 LTS. (CVE-2017-16845)\n\nCyrille Chatras discovered that QEMU incorrectly handled multiboot. An\nattacker could use this issue to cause QEMU to crash, resulting in a denial\nof service, or possibly execute arbitrary code on the host. In the default\ninstallation, when QEMU is used with libvirt, attackers would be isolated\nby the libvirt AppArmor profile. (CVE-2018-7550)\n\nRoss Lagerwall discovered that QEMU incorrectly handled the Cirrus VGA\ndevice. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7858)\n","status":"published","published":"2018-05-16T12:03:54Z","modified":"2026-02-10T04:41:20Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}