Filtered by vendor Qemu Subscriptions
Total 414 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-25742 1 Qemu 1 Qemu 2024-11-21 3.2 Low
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
CVE-2020-25741 1 Qemu 1 Qemu 2024-11-21 3.2 Low
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
CVE-2020-25723 3 Debian, Qemu, Redhat 5 Debian Linux, Qemu, Advanced Virtualization and 2 more 2024-11-21 3.2 Low
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
CVE-2020-25625 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 5.3 Medium
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
CVE-2020-25624 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 5.0 Medium
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
CVE-2020-25085 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 5.0 Medium
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
CVE-2020-25084 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 3.2 Low
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
CVE-2020-24352 1 Qemu 1 Qemu 2024-11-21 5.5 Medium
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
CVE-2020-24165 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 8.8 High
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.
CVE-2020-1711 4 Debian, Opensuse, Qemu and 1 more 9 Debian Linux, Leap, Qemu and 6 more 2024-11-21 7.7 High
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
CVE-2020-17380 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 6.3 Medium
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
CVE-2020-16092 5 Canonical, Debian, Opensuse and 2 more 8 Ubuntu Linux, Debian Linux, Leap and 5 more 2024-11-21 3.8 Low
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
CVE-2020-15863 3 Canonical, Debian, Qemu 3 Ubuntu Linux, Debian Linux, Qemu 2024-11-21 5.3 Medium
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
CVE-2020-15859 3 Debian, Qemu, Redhat 3 Debian Linux, Qemu, Enterprise Linux 2024-11-21 3.3 Low
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
CVE-2020-15469 2 Debian, Qemu 2 Debian Linux, Qemu 2024-11-21 2.3 Low
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
CVE-2020-14415 2 Canonical, Qemu 2 Ubuntu Linux, Qemu 2024-11-21 3.3 Low
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
CVE-2020-14394 3 Fedoraproject, Qemu, Redhat 5 Extra Packages For Enterprise Linux, Fedora, Qemu and 2 more 2024-11-21 3.2 Low
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
CVE-2020-14364 6 Canonical, Debian, Fedoraproject and 3 more 14 Ubuntu Linux, Debian Linux, Fedora and 11 more 2024-11-21 5.0 Medium
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
CVE-2020-13800 3 Canonical, Opensuse, Qemu 3 Ubuntu Linux, Leap, Qemu 2024-11-21 6.0 Medium
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
CVE-2020-13791 1 Qemu 1 Qemu 2024-11-21 5.5 Medium
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.