SB2014042304 - Multiple vulnerabilities in QEMU

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014042304

SB2014042304 - Multiple vulnerabilities in QEMU

Published: April 23, 2014 Updated: August 10, 2020

Security Bulletin ID SB2014042304
Severity
High
Patch available
NO
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 94%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2013-4542)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.


2) Code Injection (CVE-ID: CVE-2013-6399)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.


3) Buffer overflow (CVE-ID: CVE-2014-0182)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.


4) Heap-based buffer overflow (CVE-ID: CVE-2014-3461)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in hw/usb/bus.c in QEMU 1.6.2. A remote attacker can use crafted savevm data to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Buffer overflow (CVE-ID: CVE-2013-4526)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.


6) Buffer overflow (CVE-ID: CVE-2013-4527)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.


7) Buffer overflow (CVE-ID: CVE-2013-4529)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.


8) Buffer overflow (CVE-ID: CVE-2013-4530)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.


9) Buffer overflow (CVE-ID: CVE-2013-4531)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.


10) Buffer overflow (CVE-ID: CVE-2013-4533)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.


11) Buffer overflow (CVE-ID: CVE-2013-4534)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.


12) Code Injection (CVE-ID: CVE-2013-4537)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.


13) Buffer overflow (CVE-ID: CVE-2013-4538)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.


14) Buffer overflow (CVE-ID: CVE-2013-4539)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.


15) Buffer overflow (CVE-ID: CVE-2013-4540)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.


16) Buffer overflow (CVE-ID: CVE-2013-4541)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.


17) Input validation error (CVE-ID: CVE-2014-2894)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References