Search CVE reports
141 – 150 of 492 results
Some fixes available 2 of 5
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This...
4 affected packages
libslirp, qemu, qemu-kvm, slirp4netns
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libslirp | Not affected | Not affected | Not affected | Fixed | Not in release |
| qemu | Not affected | Not affected | Not affected | Not affected | Fixed |
| qemu-kvm | Not in release | Not in release | Not in release | Not in release | Not in release |
| slirp4netns | Not affected | Not affected | Not affected | Vulnerable | Not in release |
Some fixes available 16 of 17
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | Fixed | Fixed | Fixed | Fixed | Fixed |
| qemu-kvm | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 1 of 2
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Not affected |
| qemu-kvm | — | — | — | Not in release | Not in release |
Some fixes available 1 of 2
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted...
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Not affected |
| qemu-kvm | — | — | — | Not in release | Not in release |
Some fixes available 1 of 2
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Not affected |
| qemu-kvm | — | — | — | Not in release | Not in release |
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Not affected |
| qemu-kvm | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 3 of 4
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | Not affected | Not affected | Not affected | Fixed |
| qemu-kvm | — | Not in release | Not in release | Not in release | Not in release |
Some fixes available 4 of 5
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Fixed |
| qemu-kvm | — | — | — | Not in release | Not in release |
Some fixes available 4 of 5
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Fixed |
| qemu-kvm | — | — | — | Not in release | Not in release |
Some fixes available 4 of 5
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
2 affected packages
qemu, qemu-kvm
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qemu | — | — | — | Fixed | Fixed |
| qemu-kvm | — | — | — | Not in release | Not in release |