Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:qemu:qemu:2.7.0:rc3:*:*:*:*:*:*
  • CPE Name Search: true
There are 164 matching records.
Displaying matches 161 through 164.
Vuln ID Summary CVSS Severity
CVE-2016-7423

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

Published: October 10, 2016; 12:59:02 PM -0400
V3.1: 4.4 MEDIUM
V2.0: 2.1 LOW
CVE-2016-7909

The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.

Published: October 05, 2016; 12:59:12 PM -0400
V3.1: 4.4 MEDIUM
V2.0: 4.9 MEDIUM
CVE-2016-7908

The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

Published: October 05, 2016; 12:59:11 PM -0400
V3.1: 4.4 MEDIUM
V2.0: 2.1 LOW
CVE-2016-7907

The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

Published: October 05, 2016; 12:59:10 PM -0400
V3.1: 4.4 MEDIUM
V2.0: 2.1 LOW