xen (SUSE:Linux Enterprise Server 12-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12-LTSS package xen, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (154)

• CVE-2017-10920 — CVSS 10.0 (critical): The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a…
• CVE-2017-10921 — CVSS 10.0 (critical): The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping…
• CVE-2017-10918 — CVSS 10.0 (critical): Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host…
• CVE-2017-10912 — CVSS 10.0 (critical): Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.
• CVE-2016-4002 — CVSS 9.8 (critical): Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets…
• CVE-2018-17963 — CVSS 9.8 (critical): qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service…
• CVE-2017-10913 — CVSS 9.8 (critical): The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows…
• CVE-2018-20815 — CVSS 9.8 (critical): In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
• CVE-2017-10917 — CVSS 9.1 (critical): Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of…
• CVE-2017-15597 — CVSS 9.1 (critical): An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable…
• CVE-2017-10915 — CVSS 9.0 (critical): The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest…
• CVE-2017-14319 — CVSS 8.8 (high): A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to…
• CVE-2018-7550 — CVSS 8.8 (high): The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on…
• CVE-2018-19966 — CVSS 8.8 (high): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain…
• CVE-2016-3710 — CVSS 8.8 (high): The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to…
• CVE-2016-3960 — CVSS 8.8 (high): Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly…
• CVE-2017-8905 — CVSS 8.8 (high): Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the…
• CVE-2017-15595 — CVSS 8.8 (high): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack…
• CVE-2017-15594 — CVSS 8.8 (high): An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain…
• CVE-2017-15592 — CVSS 8.8 (high): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly…
• CVE-2017-15590 — CVSS 8.8 (high): An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain…
• CVE-2016-6258 — CVSS 8.8 (high): The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges…
• CVE-2017-14316 — CVSS 8.8 (high): A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first…
• CVE-2017-12137 — CVSS 8.8 (high): arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
• CVE-2017-12135 — CVSS 8.8 (high): Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via…
• CVE-2016-9383 — CVSS 8.8 (high): Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive…
• CVE-2016-4001 — CVSS 8.6 (high): Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is…
• CVE-2016-4480 — CVSS 8.4 (high): The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table…
• CVE-2016-7092 — CVSS 8.2 (high): The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via…
• CVE-2018-11806 — CVSS 8.2 (high): m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
• CVE-2017-7228 — CVSS 8.2 (high): An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix…
• CVE-2016-7093 — CVSS 8.2 (high): Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges…
• CVE-2017-10914 — CVSS 8.1 (high): The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial…
• CVE-2016-9379 — CVSS 7.9 (high): The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to…
• CVE-2017-17566 — CVSS 7.8 (high): An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS…
• CVE-2017-17564 — CVSS 7.8 (high): An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS…
• CVE-2017-17563 — CVSS 7.8 (high): An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS…
• CVE-2017-7980 — CVSS 7.8 (high): Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute…
• CVE-2018-19962 — CVSS 7.8 (high): An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because…
• CVE-2016-5126 — CVSS 7.8 (high): Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of…
• CVE-2016-10013 — CVSS 7.8 (high): Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during…
• CVE-2017-15588 — CVSS 7.8 (high): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race…
• CVE-2016-5338 — CVSS 7.8 (high): The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of…
• CVE-2018-8897 — CVSS 7.8 (high): A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the…
• CVE-2019-6778 — CVSS 7.8 (high): In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
• CVE-2016-9386 — CVSS 7.8 (high): The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest…
• CVE-2016-9382 — CVSS 7.8 (high): Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or…
• CVE-2018-19961 — CVSS 7.8 (high): An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB…
• CVE-2017-10922 — CVSS 7.5 (high): The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of…
• CVE-2016-9380 — CVSS 7.5 (high): The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to…
• CVE-2016-9381 — CVSS 7.5 (high): Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka…
• CVE-2016-9637 — CVSS 7.5 (high): The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest…
• CVE-2017-10664 — CVSS 7.5 (high): qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by…
• CVE-2017-8309 — CVSS 7.5 (high): Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by…
• CVE-2018-12617 — CVSS 7.5 (high): qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer…
• CVE-2018-17958 — CVSS 7.5 (high): Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
• CVE-2018-17962 — CVSS 7.5 (high): Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
• CVE-2016-4962 — CVSS 6.7 (medium): The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption…
• CVE-2016-4439 — CVSS 6.7 (medium): The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer…
• CVE-2016-6351 — CVSS 6.7 (medium): The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows…
• CVE-2016-7154 — CVSS 6.7 (medium): Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service…
• CVE-2017-5579 — CVSS 6.5 (medium): Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to…
• CVE-2016-9907 — CVSS 6.5 (medium): Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while…
• CVE-2016-9911 — CVSS 6.5 (medium): Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing…
• CVE-2016-9921 — CVSS 6.5 (medium): Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while…
• CVE-2017-10911 — CVSS 6.5 (medium): The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain…
• CVE-2018-19967 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang)…
• CVE-2016-4020 — CVSS 6.5 (medium): The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS…
• CVE-2014-3672 — CVSS 6.5 (medium): The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by…
• CVE-2018-12893 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with…
• CVE-2018-12891 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly…
• CVE-2017-12855 — CVSS 6.5 (medium): Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify…
• CVE-2018-10839 — CVSS 6.5 (medium): Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer…
• CVE-2018-10471 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and…
• CVE-2017-8112 — CVSS 6.5 (medium): hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and…
• CVE-2017-15589 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an…
• CVE-2017-15593 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference…
• CVE-2017-6505 — CVSS 6.5 (medium): The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a…
• CVE-2017-6414 — CVSS 6.5 (medium): Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of…
• CVE-2017-5856 — CVSS 6.5 (medium): Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to…
• CVE-2017-5526 — CVSS 6.5 (medium): Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host…
• CVE-2016-7777 — CVSS 6.3 (medium): Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or…
• CVE-2016-5107 — CVSS 6.0 (medium): The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS…
• CVE-2016-9385 — CVSS 6.0 (medium): The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial…
• CVE-2016-8667 — CVSS 6.0 (medium): The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service…
• CVE-2016-8909 — CVSS 6.0 (medium): The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of…
• CVE-2016-10024 — CVSS 6.0 (medium): Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the…
• CVE-2016-9101 — CVSS 6.0 (medium): Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory…
• CVE-2016-5106 — CVSS 6.0 (medium): The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation…
• CVE-2016-8910 — CVSS 6.0 (medium): The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial…
• CVE-2016-10155 — CVSS 6.0 (medium): Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service…
• CVE-2016-8669 — CVSS 6.0 (medium): The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a…
• CVE-2018-5683 — CVSS 6.0 (medium): The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process…
• CVE-2017-15289 — CVSS 6.0 (medium): The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service…
• CVE-2016-6836 — CVSS 6.0 (medium): The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain…
• CVE-2016-6835 — CVSS 6.0 (medium): The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to…
• CVE-2016-4952 — CVSS 6.0 (medium): QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to…
• CVE-2016-4454 — CVSS 6.0 (medium): The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory…
• CVE-2016-4441 — CVSS 6.0 (medium): The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which…
• CVE-2016-4037 — CVSS 6.0 (medium): The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite…
• CVE-2016-8576 — CVSS 6.0 (medium): The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of…
• CVE-2018-12130 — CVSS 5.9 (medium): Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an…
• CVE-2018-19665 — CVSS 5.7 (medium): The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.
• CVE-2017-5753 — CVSS 5.6 (medium): Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an…
• CVE-2018-12126 — CVSS 5.6 (medium): Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an…
• CVE-2017-5754 — CVSS 5.6 (medium): Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of…
• CVE-2017-9330 — CVSS 5.6 (medium): QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of…
• CVE-2017-17565 — CVSS 5.6 (medium): An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and…
• CVE-2018-3665 — CVSS 5.6 (medium): System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local…
• CVE-2017-14317 — CVSS 5.6 (medium): A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a…
• CVE-2018-10472 — CVSS 5.6 (medium): An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via…
• CVE-2018-3646 — CVSS 5.6 (medium): Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information…
• CVE-2018-19965 — CVSS 5.6 (medium): An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0]…
• CVE-2019-11091 — CVSS 5.6 (medium): Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may…
• CVE-2018-12127 — CVSS 5.6 (medium): Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an…
• CVE-2017-5715 — CVSS 5.6 (medium): Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of…
• CVE-2016-9603 — CVSS 5.5 (medium): A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could…
• CVE-2017-2615 — CVSS 5.5 (medium): Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur…
• CVE-2017-5898 — CVSS 5.5 (medium): Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID…
• CVE-2017-5973 — CVSS 5.5 (medium): The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of…
• CVE-2017-7718 — CVSS 5.5 (medium): hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds…
• CVE-2016-5337 — CVSS 5.5 (medium): The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory…
• CVE-2016-5403 — CVSS 5.5 (medium): The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory…
• CVE-2017-9374 — CVSS 5.5 (medium): Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a…
• CVE-2017-9503 — CVSS 5.5 (medium): QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users…
• CVE-2017-13672 — CVSS 5.5 (medium): QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of…
• CVE-2017-11434 — CVSS 5.5 (medium): The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service…
• CVE-2019-9824 — CVSS 5.5 (medium): tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information…
• CVE-2018-18438 — CVSS 5.5 (medium): Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
• CVE-2018-18849 — CVSS 5.5 (medium): In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.
• CVE-2016-3712 — CVSS 5.5 (medium): Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process…
• CVE-2018-3639 — CVSS 5.5 (medium): Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior…
• CVE-2017-10806 — CVSS 5.5 (medium): Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service…
• CVE-2016-9922 — CVSS 5.5 (medium): The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest…
• CVE-2016-9776 — CVSS 5.5 (medium): QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It…
• CVE-2017-2620 — CVSS 5.5 (medium): Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The…
• CVE-2017-2633 — CVSS 5.4 (medium): An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while…
• CVE-2016-4963 — CVSS 4.7 (medium): The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service…
• CVE-2014-8106 — CVSS 4.6 (medium): Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute…
• CVE-2016-6888 — CVSS 4.4 (medium): Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators…
• CVE-2016-5105 — CVSS 4.4 (medium): The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support…
• CVE-2016-4453 — CVSS 4.4 (medium): The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite…
• CVE-2016-7908 — CVSS 4.4 (medium): The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when…
• CVE-2017-11334 — CVSS 4.4 (medium): The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial…
• CVE-2017-18030 — CVSS 4.4 (medium): The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of…
• CVE-2016-7909 — CVSS 4.4 (medium): The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of…
• CVE-2016-6833 — CVSS 4.4 (medium): Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS…
• CVE-2016-5238 — CVSS 4.4 (medium): The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write…
• CVE-2016-6834 — CVSS 4.4 (medium): The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to…
• CVE-2016-7094 — CVSS 4.1 (medium): Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a…
• CVE-2016-3159 — CVSS 3.8 (low): The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64…
• CVE-2016-3158 — CVSS 3.8 (low): The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64…
• CVE-2016-9932 — CVSS 3.3 (low): CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host…
• CVE-2014-3615 — CVSS 2.1 (low): The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.