CVE-2014-0144

CWE-20 — Improper Input Validation9 documents8 sources
Severity
8.6HIGH
EPSS
0.6%
top 29.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Qemu QemuRedhat Enterprise Linux DesktopRedhat Enterprise Linux EUS+6 more
Timeline
PublishedSep 29
Latest updateSep 30

Description

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages7 packages

▶NVDqemu/qemu< 2.0.0
▶Debianqemu< 2.0.0+dfsg-1+3

Also affects: Enterprise Linux 6.5

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-p3jv-vmvr-2v4v: QEMU before 2↗2022-09-30
▶
OSV
CVE-2014-0144: QEMU before 2↗2022-09-29
▶
CVEList
CVE-2014-0144: QEMU before 2↗2020-02-11
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2014-09-08
▶
Red Hat
Qemu: block: missing input validation↗2014-03-26
▶
Debian
CVE-2014-0144: qemu - QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other ima...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-0144 Qemu: block: missing input validation [fedora-all]↗2014-04-11
▶
Bugzilla
CVE-2014-0144 Qemu: block: missing input validation↗2014-03-21
▶
CVE-2014-0144 (HIGH CVSS 8.6) | QEMU before 2.0.0 block drivers for | cvebase.io