Debian Qemu vulnerabilities

CVE-2016-1981 [MEDIUM] CVE-2016-1981: qemu - QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerab... QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instan

CVE-2016-1922 [MEDIUM] CVE-2016-1922: qemu - QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows gue... QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in D

CVE-2016-10028 [MEDIUM] CVE-2016-10028: qemu - The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Qui... The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0. Scope: local bookworm: resolved (fixed in

CVE-2016-9776 [MEDIUM] CVE-2016-9776: qemu - QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emula... QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS. Scope: local bookworm: resolved (fixed in 1:2.8+dfsg-1) bullsey

CVE-2025-54566 [MEDIUM] CVE-2025-54566: qemu - hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, ... hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:10.0.3+ds-1) sid: resolved (fixed in 1:10.0.3+ds-1) trixie: resolved (fixed in 1:10.0.2+ds-2+deb13u1)

CVE-2020-25624 [MEDIUM] CVE-2020-25624: qemu - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values ob... hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. Scope: local bookworm: resolved (fixed in 1:5.2+dfsg-1) bullseye: resolved (fixed in 1:5.2+dfsg-1) forky: resolved (fixed in 1:5.2+dfsg-1) sid: resolved (fixed in 1:5.2+dfsg-1) trixie: resolved (fixed in 1:5.2+dfsg-1)

CVE-2013-4544 [MEDIUM] CVE-2013-4544: qemu - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users ... hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information. Scope: local bookworm: resolved (fixed in 2.0.0+dfsg-1) bullseye: resolved (

CVE-2020-29130 [MEDIUM] CVE-2020-29130: libslirp - slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to rea... slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Scope: local bookworm: resolved (fixed in 4.4.0-1) bullseye: resolved (fixed in 4.4.0-1) forky: resolved (fixed in 4.4.0-1) sid: resolved (fixed in 4.4.0-1) trixie: resolved (fixed in 4.4.0-1)

CVE-2026-3196 [LOW] CVE-2026-3196: qemu bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:10.2.2+ds-1) sid: resolved (fixed in 1:10.2.2+ds-1) trixie: open

CVE-2017-17381 [MEDIUM] CVE-2017-17381: qemu - The Virtio Vring implementation in QEMU allows local OS guest users to cause a d... The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings. Scope: local bookworm: resolved (fixed in 1:2.11+dfsg-1) bullseye: resolved (fixed in 1:2.11+dfsg-1) forky: resolved (fixed in 1:2.11+dfsg-1) sid: resolved (fixed in 1:

CVE-2017-9330 [MEDIUM] CVE-2017-9330: qemu - QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation s... QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505. Scope: local bookworm: resolved (fixed in 1:2.8+dfsg-7) bullseye: resolved (fixed in 1:2.8+dfsg-7) forky: resolved (fixed i

CVE-2016-8910 [MEDIUM] CVE-2016-8910: qemu - The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emula... The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count. Scope: local bookworm: resolved (fixed in 1:2.8+dfsg-1) bullseye: resolved (fixed in 1:2.8+dfsg-1) forky: resolved (fixed in 1

CVE-2016-8576 [MEDIUM] CVE-2016-8576: qemu - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) a... The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process. Scope: local bookworm: resolved (fixed in 1:2.8+dfsg-1) bullseye: resolved (fixed in 1:2.8+dfsg

CVE-2021-4158 [MEDIUM] CVE-2021-4158: qemu - A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious... A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-2) bullseye: resolved forky: resolved (fixed in 1:6.2+dfsg-2) sid: resolved (fixed in 1:6.2+dfsg-2)

CVE-2016-2841 [MEDIUM] CVE-2016-2841: qemu - The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c... The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control. Scope: local bookworm: resolved (fixed in 1:2.6+dfsg-1) bullseye: resolved (f

CVE-2016-5106 [MEDIUM] CVE-2016-5106: qemu - The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when buil... The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command. Scope: local bookworm: resolved (fixed in 1:2.6+dfsg-2) bullseye: re

CVE-2020-35504 [MEDIUM] CVE-2020-35504: qemu - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU ... A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed in 1:6.0+dfsg-3) bullseye: open forky: r

CVE-2024-26328 [MEDIUM] CVE-2024-26328: qemu - An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie... An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled. Scope: local bookworm: resolved (fixed in 1:7.2+dfsg-7+deb12u6) bullseye: resolved forky: resolved (fixed in 1:8.2.3+ds-1) sid: resolved (fixed in 1:8.2.3+ds-1) trixie: resolved (fi

CVE-2017-13672 [MEDIUM] CVE-2017-13672: qemu - QEMU (aka Quick Emulator), when built with the VGA display emulator support, all... QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update. Scope: local bookworm: resolved (fixed in 1:2.10.0-1) bullseye: resolved (fixed in 1:2.10.0-1) forky: resolved (fixed in 1:2.10.0-1) sid: reso

CVE-2018-19364 [MEDIUM] CVE-2018-19364: qemu - hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is bei... hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome. Scope: local bookworm: resolved (fixed in 1:3.1+dfsg-1) bullseye: resolved (fixed in 1:3.1+dfsg-1) forky: resolved (fixed in 1:3.1+dfsg-1) sid: resolved (fixed in 1:3.1+dfsg-1) trixie: resolved (fixed in 1: