Published: 10/08/2017 Updated: 13/02/2023

CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 169

Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P

The qcow2_open function in the (block/qcow2.c) in QEMU prior to 1.7.2 and 2.x prior to 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu
qemu qemu 2.0.0

Several security issues were fixed in QEMU ...

Debian Bug report logs - #742730 image format processing issues: lack of input validation Packages: qemu-kvm, qemu; Maintainer for qemu-kvm is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Source for qemu-kvm is src:qemu (PTS, buildd, popcon) Maintainer for qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebia ...

Debian Bug report logs - #762532 CVE-2014-3640: qemu: slirp: NULL pointer deref in sosendto() Package: qemu; Maintainer for qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Source for qemu is src:qemu (PTS, buildd, popcon) Reported by: Henri Salo <henri@nervfi> Date: Tue, 23 Sep 2014 06:57:12 UTC ...

Several vulnerabilities were discovered in qemu, a fast processor emulator: Various security issues have been found in the block qemu drivers Malformed disk images might result in the execution of arbitrary code A NULL pointer dereference in SLIRP may result in denial of service An information leak was discovered in the VGA emulation For t ...

CWE-476 https://bugzilla.redhat.com/show_bug.cgi?id=1078232 http://www.openwall.com/lists/oss-security/2014/03/26/8 http://rhn.redhat.com/errata/RHSA-2014-0421.html http://rhn.redhat.com/errata/RHSA-2014-0420.html http://www.debian.org/security/2014/dsa-3044 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=11b128f4062dd7f89b14abc8877ff20d41b28be9 https://usn.ubuntu.com/2342-1/https://nvd.nist.gov

CVE-2014-0146

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect