442 results · Feed
-
Unscored —
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a writ…
-
Unscored —
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
-
Unscored —CVE-2020-14364 Public exploit
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue …
-
Unscored —
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in th…
-
Unscored —
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
-
Unscored —
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e a…
-
Unscored —
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during pac…
-
Unscored —
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the d…
-
Unscored —
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…
-
Unscored —
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Medium 5.5
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in vers…
-
Unscored —
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which al…
-
Unscored —
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the en…
-
Unscored —
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index va…
-
Unscored —
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x …
-
Unscored —
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
-
Unscored —
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queu…
-
Unscored —
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which…
-
Unscored —
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_w…
-
Low 3.3
A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU versio…
-
Unscored —
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs…
-
High 7.5
libslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
-
Unscored —
hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not va…
-
Unscored —
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer …
-
Unscored —
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz …
-
High 7.7
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2…
-
Unscored —
The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary f…
-
Unscored —
Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when ca…
-
Unscored —
Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are v…
-
Unscored —
QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential …
-
Unscored —
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in la…
-
Unscored —
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor dat…
-
Unscored —
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process …
-
Unscored —
The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (in…
-
Unscored —
Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users…
-
Unscored —
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands …
-
Unscored —
Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on…
-
Unscored —
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QE…
-
Unscored —
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space…