{"kind": "product", "path": "vulns/ubuntu-20.04-lts/qemu", "name": "qemu", "product": "qemu", "ecosystem": "Ubuntu:20.04:LTS", "items": [{"id": "CVE-2024-7730", "noindex": false, "published": "2024-11-14T12:11:50.456Z", "modified": "2024-11-14T19:32:39.807Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-7730", "title": "Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()", "description": "A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero.", "references": ["https://access.redhat.com/security/cve/CVE-2024-7730", "https://bugzilla.redhat.com/show_bug.cgi?id=2304289", "https://nvd.nist.gov/vuln/detail/CVE-2024-7730"], "fixes": ["1:4.2-3ubuntu6.30"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "USN-6567-2", "noindex": true, "published": "2024-06-06T12:29:55Z", "modified": "2026-02-10T04:43:27Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/usn-6567-2", "title": "qemu regression", "description": "USN-6567-1 fixed vulnerabilities QEMU. The fix for CVE-2023-2861 was too\nrestrictive and introduced a behaviour change leading to a regression in\ncertain environments. This update fixes the problem.\n\nOriginal advisory details:\n\n Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the\n USB xHCI controller device. A privileged guest attacker could possibly use\n this issue to cause QEMU to crash, leading to a denial of service. This\n issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2020-14394)\n \n It was discovered that QEMU incorrectly handled the TCG Accelerator. A\n local attacker could use this issue to cause QEM", "references": ["https://ubuntu.com/security/notices/USN-6567-2", "https://launchpad.net/bugs/2065579", "https://osv.dev/vulnerability/USN-6567-2"], "fixes": ["1:4.2-3ubuntu6.29"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-2861", "noindex": false, "published": "2023-12-06T06:19:40.625Z", "modified": "2024-08-02T06:33:05.791Z", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00376, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-2861", "title": "Qemu: 9pfs: improper access control on special files", "description": "A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.", "references": ["https://access.redhat.com/security/cve/CVE-2023-2861", "https://bugzilla.redhat.com/show_bug.cgi?id=2219266", "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-5088", "noindex": false, "published": "2023-11-03T13:58:50.085Z", "modified": "2026-02-25T18:18:36.359Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-5088", "title": "Qemu: improper ide controller reset can lead to mbr overwrite", "description": "A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.", "references": ["https://access.redhat.com/errata/RHSA-2024:2135", "https://access.redhat.com/errata/RHSA-2024:2962", "https://access.redhat.com/security/cve/CVE-2023-5088"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2020-24165", "noindex": false, "published": "2023-08-28T00:00:00.000Z", "modified": "2024-08-04T15:05:11.905Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.00697, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-24165", "title": "CVE-2020-24165", "description": "An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.", "references": ["https://bugs.launchpad.net/qemu/+bug/1863025", "https://pastebin.com/iqCbjdT8", "https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-3180", "noindex": false, "published": "2023-08-03T14:31:36.083Z", "modified": "2024-09-25T19:56:37.371Z", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-3180", "title": "Heap buffer overflow in virtio_crypto_sym_op_helper()", "description": "A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.", "references": ["https://access.redhat.com/security/cve/CVE-2023-3180", "https://bugzilla.redhat.com/show_bug.cgi?id=2222424", "https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-3019", "noindex": false, "published": "2023-07-24T15:19:19.804Z", "modified": "2026-05-12T10:12:38.346Z", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00318, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-3019", "title": "Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()", "description": "A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.", "references": ["https://access.redhat.com/errata/RHSA-2024:0135", "https://access.redhat.com/errata/RHSA-2024:0404", "https://access.redhat.com/errata/RHSA-2024:0569"], "fixes": ["1:4.2-3ubuntu6.30"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-3354", "noindex": false, "published": "2023-07-11T16:16:56.294Z", "modified": "2025-02-13T16:55:08.379Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.01606, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-3354", "title": "Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service", "description": "A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.", "references": ["https://access.redhat.com/security/cve/CVE-2023-3354", "https://bugzilla.redhat.com/show_bug.cgi?id=2216478", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-1544", "noindex": false, "published": "2023-03-23T00:00:00.000Z", "modified": "2025-11-03T19:27:58.423Z", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00309, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-1544", "title": "Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()", "description": "A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.", "references": ["https://access.redhat.com/security/cve/CVE-2023-1544", "https://bugzilla.redhat.com/show_bug.cgi?id=2180364", "https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-0330", "noindex": false, "published": "2023-03-06T00:00:00.000Z", "modified": "2024-08-02T05:10:55.143Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-0330", "title": "Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow", "description": "A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.", "references": ["https://access.redhat.com/security/cve/CVE-2023-0330", "https://bugzilla.redhat.com/show_bug.cgi?id=2160151", "https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html"], "fixes": ["1:4.2-3ubuntu6.27"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2022-4144", "noindex": false, "published": "2022-11-29T00:00:00.000Z", "modified": "2025-04-14T18:09:55.614Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-4144", "title": "CVE-2022-4144", "description": "An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2148506", "https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/"], "fixes": ["1:4.2-3ubuntu6.27"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2022-0216", "noindex": false, "published": "2022-08-26T00:00:00.000Z", "modified": "2024-08-02T23:18:42.831Z", "cvss": 4.4, "cvss_vector": "", "severity": "medium", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-0216", "title": "CVE-2022-0216", "description": "A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.", "references": ["https://starlabs.sg/advisories/22/22-0216/", "https://bugzilla.redhat.com/show_bug.cgi?id=2036953", "https://gitlab.com/qemu-project/qemu/-/issues/972"], "fixes": ["1:4.2-3ubuntu6.24"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2020-14394", "noindex": false, "published": "2022-08-17T00:00:00.000Z", "modified": "2024-08-04T12:46:34.221Z", "cvss": 3.2, "cvss_vector": "", "severity": "low", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-14394", "title": "CVE-2020-14394", "description": "An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1908004", "https://gitlab.com/qemu-project/qemu/-/issues/646", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/"], "fixes": ["1:4.2-3ubuntu6.28"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-3750", "noindex": false, "published": "2022-05-02T18:48:12.000Z", "modified": "2024-08-03T17:09:08.277Z", "cvss": 8.2, "cvss_vector": "", "severity": "high", "epss": 0.00513, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3750", "title": "CVE-2021-3750", "description": "A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1999073", "https://gitlab.com/qemu-project/qemu/-/issues/541", "https://gitlab.com/qemu-project/qemu/-/issues/556"], "fixes": ["1:4.2-3ubuntu6.24"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-4206", "noindex": false, "published": "2022-04-29T16:19:09.000Z", "modified": "2025-03-21T18:03:39.948Z", "cvss": 8.2, "cvss_vector": "", "severity": "high", "epss": 0.00834, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-4206", "title": "CVE-2021-4206", "description": "A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2036998", "https://starlabs.sg/advisories/21-4206/", "https://www.debian.org/security/2022/dsa-5133"], "fixes": ["1:4.2-3ubuntu6.23"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-4207", "noindex": false, "published": "2022-04-29T16:07:33.000Z", "modified": "2025-03-21T18:03:41.449Z", "cvss": 8.2, "cvss_vector": "", "severity": "high", "epss": 0.00402, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-4207", "title": "CVE-2021-4207", "description": "A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2036966", "https://starlabs.sg/advisories/21-4207/", "https://www.debian.org/security/2022/dsa-5133"], "fixes": ["1:4.2-3ubuntu6.23"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2022-1050", "noindex": false, "published": "2022-03-29T00:00:00.000Z", "modified": "2024-08-02T23:47:43.236Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-1050", "title": "CVE-2022-1050", "description": "A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2069625", "https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-1050"], "fixes": ["1:4.2-3ubuntu6.27"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-3582", "noindex": false, "published": "2022-03-25T18:02:49.000Z", "modified": "2024-08-03T17:01:07.405Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.00386, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3582", "title": "CVE-2021-3582", "description": "A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a \"PVRDMA_CMD_CREATE_MR\" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1966266", "https://security.netapp.com/advisory/ntap-20220429-0003/", "https://security.gentoo.org/glsa/202208-27"], "fixes": ["1:4.2-3ubuntu6.17"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-3748", "noindex": false, "published": "2022-03-23T19:46:40.000Z", "modified": "2024-08-03T17:09:08.293Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.00522, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3748", "title": "CVE-2021-3748", "description": "A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1998514", "https://ubuntu.com/security/CVE-2021-3748", "https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6"], "fixes": ["1:4.2-3ubuntu6.21"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2021-20257", "noindex": false, "published": "2022-03-16T14:12:26.000Z", "modified": "2024-08-03T17:37:23.120Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.0037, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-20257", "title": "CVE-2021-20257", "description": "An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.", "references": ["https://www.openwall.com/lists/oss-security/2021/02/25/2", "https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.html", "https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8"], "fixes": ["1:4.2-3ubuntu6.17"], "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}]}], "total": 75, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "qemu", "path": "vulns/ubuntu-20.04-lts/qemu", "ecosystem": "Ubuntu:20.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-05-12T10:12:38.346Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}