qemu vulnerabilities (Debian)
511 vulnerabilities.
qemuDebianIn QEMU 4.2.0, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame...3.9 LowqemuDebiansd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of...5.5 MediumqemuDebianIn QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation....3.8 LowqemuDebianA potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd)...3.3 LowqemuDebianAn integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA...3.3 LowqemuDebianiscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may...3.8 LowqemuDebianlibslirp: use after free vulnerability cause a denial of service.7.5 HighqemuDebianA flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for...5.5 MediumqemuDebianhw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because...5.6 MediumqemuDebianhw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation...5.8 MediumqemuDebianQEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect...3.5 LowqemuDebianAn out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU...7.7 HighqemuDebianIn libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a...5.6 MediumqemuDebiantcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as...5.6 MediumqemuDebian** DISPUTED ** An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2...7.5 HighqemuDebianqemu - security updateNo scoreqemuDebianThe ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service ...6.5 MediumqemuDebianIn QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8...3.8 LowqemuDebianlibslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.7.5 HighqemuDebianip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet...8.8 HighqemuDebianqemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from...7.8 HighqemuDebianThe QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which...9.8 CriticalqemuDebianThe QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection,...9.8 CriticalqemuDebianqemu - regression updateNo scoreqemuDebianinterface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference.7.5 HighqemuDebianQEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of...7.5 HighqemuDebianhw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the...7.5 HighqemuDebiantcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in...5.5 MediumqemuDebianhw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares...3.3 LowqemuDebianIn QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and...5.5 MediumqemuDebianQEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of...4.4 MediumqemuDebianIn QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.7.8 HighqemuDebianIn QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which...9.8 CriticalqemuDebianhw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by...7.5 HighqemuDebianhw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a...5.5 MediumqemuDebianQEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not...7.5 HighqemuDebianhw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are...5.5 MediumqemuDebianhw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer...7.5 HighqemuDebianpvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.5.5 MediumqemuDebianv9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash)...4.7 MediumqemuDebianA flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in...5.0 MediumqemuDebianA flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in...7.0 HighqemuDebianThe Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to...5.7 MediumqemuDebianhw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a...5.5 MediumqemuDebianThe pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or...5.5 MediumqemuDebianIn Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an...5.5 MediumqemuDebianAn OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It...7.0 HighqemuDebianQemu has integer overflows because IOReadHandler and its associated functions use a signed...5.5 MediumqemuDebianQemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer...6.5 MediumqemuDebianqemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which...9.8 Critical- Show moreLoading…