csaf_suse - suse-su-2016:1318-1

suse-su-2016:1318-1

Vulnerability from csaf_suse

Published

2016-05-17 12:09

Modified

2016-05-17 12:09

Summary

Security update for xen

Notes

Title of the patch

Security update for xen

Description of the patch

xen was updated to fix 46 security issues. These security issues were fixed: - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746). - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929). - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950). - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#964644). - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925). - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627). - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431). - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947). - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360). - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918). - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832). - CVE-2015-8504: VNC: floating point exception (bsc#958493). - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988). - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007). - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009). - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006). - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387). - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387). - CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358). - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726). - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125). - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126). - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692). - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783). - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415). - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315). - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101). - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090). - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004). - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523). These non-security issues were fixed: - bsc#954872: script block-dmmd not working as expected - bsc#963923: domain weights not honored when sched-credit tslice is reduced - bsc#959695: Missing docs for xen

Patchnames

SUSE-SLE-DESKTOP-12-2016-779,SUSE-SLE-SDK-12-2016-779,SUSE-SLE-SERVER-12-2016-779

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "xen was updated to fix 46 security issues.\n\nThese security issues were fixed:\n- CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746).\n- CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929).\n- CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950).\n- CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image (bsc#964644).\n- CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452).\n- CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642).\n- CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335).\n- CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758).\n- CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925).\n- CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112).\n- CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611).\n- CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627).\n- CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function\u0027s return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431).\n- CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632).\n- CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947).\n- CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156).\n- CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360).\n- CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918).\n- CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832).\n- CVE-2015-8504: VNC: floating point exception (bsc#958493).\n- CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988).\n- CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007).\n- CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009).\n- CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006).\n- CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).\n- CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358).\n- CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269).\n- CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726).\n- CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836).\n- CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707).\n- CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125).\n- CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126).\n- CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332).\n- CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861).\n- CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862).\n- CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692).\n- CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321).\n- CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783).\n- CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415).\n- CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315).\n- CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317).\n- CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101).\n- CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090).\n- CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004).\n- XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523).\n\nThese non-security issues were fixed:\n- bsc#954872: script block-dmmd not working as expected \n- bsc#963923: domain weights not honored when sched-credit tslice is reduced\n- bsc#959695: Missing docs for xen\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-DESKTOP-12-2016-779,SUSE-SLE-SDK-12-2016-779,SUSE-SLE-SERVER-12-2016-779",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_1318-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:1318-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20161318-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:1318-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-May/002065.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 954872",
        "url": "https://bugzilla.suse.com/954872"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 956832",
        "url": "https://bugzilla.suse.com/956832"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 957988",
        "url": "https://bugzilla.suse.com/957988"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 958007",
        "url": "https://bugzilla.suse.com/958007"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 958009",
        "url": "https://bugzilla.suse.com/958009"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 958493",
        "url": "https://bugzilla.suse.com/958493"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 958523",
        "url": "https://bugzilla.suse.com/958523"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 958918",
        "url": "https://bugzilla.suse.com/958918"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 959006",
        "url": "https://bugzilla.suse.com/959006"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 959387",
        "url": "https://bugzilla.suse.com/959387"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 959695",
        "url": "https://bugzilla.suse.com/959695"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 960707",
        "url": "https://bugzilla.suse.com/960707"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 960726",
        "url": "https://bugzilla.suse.com/960726"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 960836",
        "url": "https://bugzilla.suse.com/960836"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 960861",
        "url": "https://bugzilla.suse.com/960861"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 960862",
        "url": "https://bugzilla.suse.com/960862"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 961332",
        "url": "https://bugzilla.suse.com/961332"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 961358",
        "url": "https://bugzilla.suse.com/961358"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 961692",
        "url": "https://bugzilla.suse.com/961692"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962321",
        "url": "https://bugzilla.suse.com/962321"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962335",
        "url": "https://bugzilla.suse.com/962335"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962360",
        "url": "https://bugzilla.suse.com/962360"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962611",
        "url": "https://bugzilla.suse.com/962611"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962627",
        "url": "https://bugzilla.suse.com/962627"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962632",
        "url": "https://bugzilla.suse.com/962632"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962642",
        "url": "https://bugzilla.suse.com/962642"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 962758",
        "url": "https://bugzilla.suse.com/962758"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963783",
        "url": "https://bugzilla.suse.com/963783"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963923",
        "url": "https://bugzilla.suse.com/963923"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964415",
        "url": "https://bugzilla.suse.com/964415"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964431",
        "url": "https://bugzilla.suse.com/964431"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964452",
        "url": "https://bugzilla.suse.com/964452"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964644",
        "url": "https://bugzilla.suse.com/964644"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964746",
        "url": "https://bugzilla.suse.com/964746"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964925",
        "url": "https://bugzilla.suse.com/964925"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964929",
        "url": "https://bugzilla.suse.com/964929"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964947",
        "url": "https://bugzilla.suse.com/964947"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 964950",
        "url": "https://bugzilla.suse.com/964950"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965112",
        "url": "https://bugzilla.suse.com/965112"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965156",
        "url": "https://bugzilla.suse.com/965156"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965269",
        "url": "https://bugzilla.suse.com/965269"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965315",
        "url": "https://bugzilla.suse.com/965315"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 965317",
        "url": "https://bugzilla.suse.com/965317"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 967090",
        "url": "https://bugzilla.suse.com/967090"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 967101",
        "url": "https://bugzilla.suse.com/967101"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 968004",
        "url": "https://bugzilla.suse.com/968004"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 969125",
        "url": "https://bugzilla.suse.com/969125"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 969126",
        "url": "https://bugzilla.suse.com/969126"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4527 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4527/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4529 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4529/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4530 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4530/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4533 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4533/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4534 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4537 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4537/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4538 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4538/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4539 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4539/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-0222 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-0222/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3640 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3640/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3689 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3689/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-7815 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-7815/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9718 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9718/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-1779 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-1779/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-5278 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-5278/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-6855 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-6855/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7512 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7512/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7549 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7549/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8345 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8345/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8504 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8504/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8550 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8550/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8554 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8554/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8555 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8555/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8558 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8558/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8567 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8567/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8568 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8568/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8613 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8613/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8619 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8619/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8743 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8743/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8744 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8744/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8745 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8745/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8817 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8817/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8818 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8818/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1568 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1568/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1570 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1570/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1571 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1571/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1714 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1714/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1922 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1922/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1981 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2198 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2198/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2270 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2270/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2271 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2271/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2391 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2391/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2392 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2392/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2538 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2538/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2016-05-17T12:09:35Z",
      "generator": {
        "date": "2016-05-17T12:09:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:1318-1",
      "initial_release_date": "2016-05-17T12:09:35Z",
      "revision_history": [
        {
          "date": "2016-05-17T12:09:35Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
                "product": {
                  "name": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
                  "product_id": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-libs-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-libs-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-devel-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-devel-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-doc-html-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-doc-html-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-tools-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-tools-4.4.4_02-22.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.4.4_02-22.19.1.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.4.4_02-22.19.1.x86_64",
                  "product_id": "xen-tools-domU-4.4.4_02-22.19.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12",
                  "product_id": "SUSE Linux Enterprise Desktop 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12",
                  "product_id": "SUSE Linux Enterprise Server 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64"
        },
        "product_reference": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-devel-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64"
        },
        "product_reference": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-tools-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server 12",
          "product_id": "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-doc-html-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-doc-html-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64"
        },
        "product_reference": "xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-tools-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.4.4_02-22.19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64"
        },
        "product_reference": "xen-tools-domU-4.4.4_02-22.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4527",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4527"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4527",
          "url": "https://www.suse.com/security/cve/CVE-2013-4527"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864673 for CVE-2013-4527",
          "url": "https://bugzilla.suse.com/864673"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4527",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964746 for CVE-2013-4527",
          "url": "https://bugzilla.suse.com/964746"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2013-4527"
    },
    {
      "cve": "CVE-2013-4529",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4529"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4529",
          "url": "https://www.suse.com/security/cve/CVE-2013-4529"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864678 for CVE-2013-4529",
          "url": "https://bugzilla.suse.com/864678"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4529",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964929 for CVE-2013-4529",
          "url": "https://bugzilla.suse.com/964929"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2013-4529"
    },
    {
      "cve": "CVE-2013-4530",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4530"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4530",
          "url": "https://www.suse.com/security/cve/CVE-2013-4530"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072198 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/1072198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072228 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/1072228"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864682 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/864682"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964950 for CVE-2013-4530",
          "url": "https://bugzilla.suse.com/964950"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4530"
    },
    {
      "cve": "CVE-2013-4533",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4533"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4533",
          "url": "https://www.suse.com/security/cve/CVE-2013-4533"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2013-4533",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864655 for CVE-2013-4533",
          "url": "https://bugzilla.suse.com/864655"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4533",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964644 for CVE-2013-4533",
          "url": "https://bugzilla.suse.com/964644"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4533"
    },
    {
      "cve": "CVE-2013-4534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4534",
          "url": "https://www.suse.com/security/cve/CVE-2013-4534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864811 for CVE-2013-4534",
          "url": "https://bugzilla.suse.com/864811"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4534",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964452 for CVE-2013-4534",
          "url": "https://bugzilla.suse.com/964452"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4534"
    },
    {
      "cve": "CVE-2013-4537",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4537"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4537",
          "url": "https://www.suse.com/security/cve/CVE-2013-4537"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864391 for CVE-2013-4537",
          "url": "https://bugzilla.suse.com/864391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4537",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962642 for CVE-2013-4537",
          "url": "https://bugzilla.suse.com/962642"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4537"
    },
    {
      "cve": "CVE-2013-4538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4538",
          "url": "https://www.suse.com/security/cve/CVE-2013-4538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2013-4538",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864769 for CVE-2013-4538",
          "url": "https://bugzilla.suse.com/864769"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4538",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962335 for CVE-2013-4538",
          "url": "https://bugzilla.suse.com/962335"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4538"
    },
    {
      "cve": "CVE-2013-4539",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4539"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4539",
          "url": "https://www.suse.com/security/cve/CVE-2013-4539"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2013-4539",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 864805 for CVE-2013-4539",
          "url": "https://bugzilla.suse.com/864805"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 871442 for CVE-2013-4539",
          "url": "https://bugzilla.suse.com/871442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962758 for CVE-2013-4539",
          "url": "https://bugzilla.suse.com/962758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2013-4539"
    },
    {
      "cve": "CVE-2014-0222",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-0222"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-0222",
          "url": "https://www.suse.com/security/cve/CVE-2014-0222"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2014-0222",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 877642 for CVE-2014-0222",
          "url": "https://bugzilla.suse.com/877642"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 950367 for CVE-2014-0222",
          "url": "https://bugzilla.suse.com/950367"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964925 for CVE-2014-0222",
          "url": "https://bugzilla.suse.com/964925"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-0222"
    },
    {
      "cve": "CVE-2014-3640",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3640"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3640",
          "url": "https://www.suse.com/security/cve/CVE-2014-3640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 897654 for CVE-2014-3640",
          "url": "https://bugzilla.suse.com/897654"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965112 for CVE-2014-3640",
          "url": "https://bugzilla.suse.com/965112"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-3640"
    },
    {
      "cve": "CVE-2014-3689",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3689"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3689",
          "url": "https://www.suse.com/security/cve/CVE-2014-3689"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1072223 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/1072223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189862 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/1189862"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901508 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/901508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962611 for CVE-2014-3689",
          "url": "https://bugzilla.suse.com/962611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-3689"
    },
    {
      "cve": "CVE-2014-7815",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-7815"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-7815",
          "url": "https://www.suse.com/security/cve/CVE-2014-7815"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 902737 for CVE-2014-7815",
          "url": "https://bugzilla.suse.com/902737"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962627 for CVE-2014-7815",
          "url": "https://bugzilla.suse.com/962627"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-7815"
    },
    {
      "cve": "CVE-2014-9718",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9718"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function\u0027s return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9718",
          "url": "https://www.suse.com/security/cve/CVE-2014-9718"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 928393 for CVE-2014-9718",
          "url": "https://bugzilla.suse.com/928393"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964431 for CVE-2014-9718",
          "url": "https://bugzilla.suse.com/964431"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9718"
    },
    {
      "cve": "CVE-2015-1779",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-1779"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-1779",
          "url": "https://www.suse.com/security/cve/CVE-2015-1779"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 924018 for CVE-2015-1779",
          "url": "https://bugzilla.suse.com/924018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962632 for CVE-2015-1779",
          "url": "https://bugzilla.suse.com/962632"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-1779"
    },
    {
      "cve": "CVE-2015-5278",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-5278"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-5278",
          "url": "https://www.suse.com/security/cve/CVE-2015-5278"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945989 for CVE-2015-5278",
          "url": "https://bugzilla.suse.com/945989"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964947 for CVE-2015-5278",
          "url": "https://bugzilla.suse.com/964947"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-5278"
    },
    {
      "cve": "CVE-2015-6855",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-6855"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-6855",
          "url": "https://www.suse.com/security/cve/CVE-2015-6855"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945404 for CVE-2015-6855",
          "url": "https://bugzilla.suse.com/945404"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965156 for CVE-2015-6855",
          "url": "https://bugzilla.suse.com/965156"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-6855"
    },
    {
      "cve": "CVE-2015-7512",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7512"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7512",
          "url": "https://www.suse.com/security/cve/CVE-2015-7512"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 957162 for CVE-2015-7512",
          "url": "https://bugzilla.suse.com/957162"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962360 for CVE-2015-7512",
          "url": "https://bugzilla.suse.com/962360"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-7512"
    },
    {
      "cve": "CVE-2015-7549",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7549"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7549",
          "url": "https://www.suse.com/security/cve/CVE-2015-7549"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958917 for CVE-2015-7549",
          "url": "https://bugzilla.suse.com/958917"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958918 for CVE-2015-7549",
          "url": "https://bugzilla.suse.com/958918"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-7549"
    },
    {
      "cve": "CVE-2015-8345",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8345"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8345",
          "url": "https://www.suse.com/security/cve/CVE-2015-8345"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 956829 for CVE-2015-8345",
          "url": "https://bugzilla.suse.com/956829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 956832 for CVE-2015-8345",
          "url": "https://bugzilla.suse.com/956832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8345"
    },
    {
      "cve": "CVE-2015-8504",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8504"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8504",
          "url": "https://www.suse.com/security/cve/CVE-2015-8504"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958491 for CVE-2015-8504",
          "url": "https://bugzilla.suse.com/958491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958493 for CVE-2015-8504",
          "url": "https://bugzilla.suse.com/958493"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8504"
    },
    {
      "cve": "CVE-2015-8550",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8550"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8550",
          "url": "https://www.suse.com/security/cve/CVE-2015-8550"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1020452 for CVE-2015-8550",
          "url": "https://bugzilla.suse.com/1020452"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052256 for CVE-2015-8550",
          "url": "https://bugzilla.suse.com/1052256"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 957988 for CVE-2015-8550",
          "url": "https://bugzilla.suse.com/957988"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-8550"
    },
    {
      "cve": "CVE-2015-8554",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8554"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a \"write path.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8554",
          "url": "https://www.suse.com/security/cve/CVE-2015-8554"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958007 for CVE-2015-8554",
          "url": "https://bugzilla.suse.com/958007"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-8554"
    },
    {
      "cve": "CVE-2015-8555",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8555"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8555",
          "url": "https://www.suse.com/security/cve/CVE-2015-8555"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 958009 for CVE-2015-8555",
          "url": "https://bugzilla.suse.com/958009"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-8555"
    },
    {
      "cve": "CVE-2015-8558",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8558"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8558",
          "url": "https://www.suse.com/security/cve/CVE-2015-8558"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959005 for CVE-2015-8558",
          "url": "https://bugzilla.suse.com/959005"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959006 for CVE-2015-8558",
          "url": "https://bugzilla.suse.com/959006"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 976109 for CVE-2015-8558",
          "url": "https://bugzilla.suse.com/976109"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 976111 for CVE-2015-8558",
          "url": "https://bugzilla.suse.com/976111"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8558"
    },
    {
      "cve": "CVE-2015-8567",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8567"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8567",
          "url": "https://www.suse.com/security/cve/CVE-2015-8567"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959386 for CVE-2015-8567",
          "url": "https://bugzilla.suse.com/959386"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959387 for CVE-2015-8567",
          "url": "https://bugzilla.suse.com/959387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-8567"
    },
    {
      "cve": "CVE-2015-8568",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8568"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8568",
          "url": "https://www.suse.com/security/cve/CVE-2015-8568"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959386 for CVE-2015-8568",
          "url": "https://bugzilla.suse.com/959386"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 959387 for CVE-2015-8568",
          "url": "https://bugzilla.suse.com/959387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-8568"
    },
    {
      "cve": "CVE-2015-8613",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8613"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8613",
          "url": "https://www.suse.com/security/cve/CVE-2015-8613"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961358 for CVE-2015-8613",
          "url": "https://bugzilla.suse.com/961358"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961556 for CVE-2015-8613",
          "url": "https://bugzilla.suse.com/961556"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8613"
    },
    {
      "cve": "CVE-2015-8619",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8619"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8619",
          "url": "https://www.suse.com/security/cve/CVE-2015-8619"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960334 for CVE-2015-8619",
          "url": "https://bugzilla.suse.com/960334"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965269 for CVE-2015-8619",
          "url": "https://bugzilla.suse.com/965269"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-8619"
    },
    {
      "cve": "CVE-2015-8743",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8743"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing \u0027ioport\u0027 r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8743",
          "url": "https://www.suse.com/security/cve/CVE-2015-8743"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960725 for CVE-2015-8743",
          "url": "https://bugzilla.suse.com/960725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960726 for CVE-2015-8743",
          "url": "https://bugzilla.suse.com/960726"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8743"
    },
    {
      "cve": "CVE-2015-8744",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8744"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8744",
          "url": "https://www.suse.com/security/cve/CVE-2015-8744"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960835 for CVE-2015-8744",
          "url": "https://bugzilla.suse.com/960835"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960836 for CVE-2015-8744",
          "url": "https://bugzilla.suse.com/960836"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-8744"
    },
    {
      "cve": "CVE-2015-8745",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8745"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8745",
          "url": "https://www.suse.com/security/cve/CVE-2015-8745"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960707 for CVE-2015-8745",
          "url": "https://bugzilla.suse.com/960707"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960708 for CVE-2015-8745",
          "url": "https://bugzilla.suse.com/960708"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-8745"
    },
    {
      "cve": "CVE-2015-8817",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8817"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built to use \u0027address_space_translate\u0027 to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions \u003e= 1.6.0 and \u003c= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8817",
          "url": "https://www.suse.com/security/cve/CVE-2015-8817"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969121 for CVE-2015-8817",
          "url": "https://bugzilla.suse.com/969121"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969122 for CVE-2015-8817",
          "url": "https://bugzilla.suse.com/969122"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969125 for CVE-2015-8817",
          "url": "https://bugzilla.suse.com/969125"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969126 for CVE-2015-8817",
          "url": "https://bugzilla.suse.com/969126"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8817"
    },
    {
      "cve": "CVE-2015-8818",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8818"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8818",
          "url": "https://www.suse.com/security/cve/CVE-2015-8818"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969122 for CVE-2015-8818",
          "url": "https://bugzilla.suse.com/969122"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969125 for CVE-2015-8818",
          "url": "https://bugzilla.suse.com/969125"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969126 for CVE-2015-8818",
          "url": "https://bugzilla.suse.com/969126"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8818"
    },
    {
      "cve": "CVE-2016-1568",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1568"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1568",
          "url": "https://www.suse.com/security/cve/CVE-2016-1568"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961332 for CVE-2016-1568",
          "url": "https://bugzilla.suse.com/961332"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961333 for CVE-2016-1568",
          "url": "https://bugzilla.suse.com/961333"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1568"
    },
    {
      "cve": "CVE-2016-1570",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1570"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1570",
          "url": "https://www.suse.com/security/cve/CVE-2016-1570"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960861 for CVE-2016-1570",
          "url": "https://bugzilla.suse.com/960861"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-1570"
    },
    {
      "cve": "CVE-2016-1571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1571",
          "url": "https://www.suse.com/security/cve/CVE-2016-1571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960861 for CVE-2016-1571",
          "url": "https://bugzilla.suse.com/960861"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 960862 for CVE-2016-1571",
          "url": "https://bugzilla.suse.com/960862"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1571"
    },
    {
      "cve": "CVE-2016-1714",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1714"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1714",
          "url": "https://www.suse.com/security/cve/CVE-2016-1714"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961691 for CVE-2016-1714",
          "url": "https://bugzilla.suse.com/961691"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961692 for CVE-2016-1714",
          "url": "https://bugzilla.suse.com/961692"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1714"
    },
    {
      "cve": "CVE-2016-1922",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1922"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, \u0027current_cpu\u0027 remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1922",
          "url": "https://www.suse.com/security/cve/CVE-2016-1922"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962320 for CVE-2016-1922",
          "url": "https://bugzilla.suse.com/962320"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 962321 for CVE-2016-1922",
          "url": "https://bugzilla.suse.com/962321"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-1922"
    },
    {
      "cve": "CVE-2016-1981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1981",
          "url": "https://www.suse.com/security/cve/CVE-2016-1981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963782 for CVE-2016-1981",
          "url": "https://bugzilla.suse.com/963782"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963783 for CVE-2016-1981",
          "url": "https://bugzilla.suse.com/963783"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-1981"
    },
    {
      "cve": "CVE-2016-2198",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2198"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2198",
          "url": "https://www.suse.com/security/cve/CVE-2016-2198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964413 for CVE-2016-2198",
          "url": "https://bugzilla.suse.com/964413"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 964415 for CVE-2016-2198",
          "url": "https://bugzilla.suse.com/964415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-2198"
    },
    {
      "cve": "CVE-2016-2270",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2270"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2270",
          "url": "https://www.suse.com/security/cve/CVE-2016-2270"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965315 for CVE-2016-2270",
          "url": "https://bugzilla.suse.com/965315"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-2270"
    },
    {
      "cve": "CVE-2016-2271",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2271"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2271",
          "url": "https://www.suse.com/security/cve/CVE-2016-2271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 965317 for CVE-2016-2271",
          "url": "https://bugzilla.suse.com/965317"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-2271"
    },
    {
      "cve": "CVE-2016-2391",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2391"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2391",
          "url": "https://www.suse.com/security/cve/CVE-2016-2391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967012 for CVE-2016-2391",
          "url": "https://bugzilla.suse.com/967012"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967013 for CVE-2016-2391",
          "url": "https://bugzilla.suse.com/967013"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967101 for CVE-2016-2391",
          "url": "https://bugzilla.suse.com/967101"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-2391"
    },
    {
      "cve": "CVE-2016-2392",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2392"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2392",
          "url": "https://www.suse.com/security/cve/CVE-2016-2392"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967012 for CVE-2016-2392",
          "url": "https://bugzilla.suse.com/967012"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967090 for CVE-2016-2392",
          "url": "https://bugzilla.suse.com/967090"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-2392"
    },
    {
      "cve": "CVE-2016-2538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2538",
          "url": "https://www.suse.com/security/cve/CVE-2016-2538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967969 for CVE-2016-2538",
          "url": "https://bugzilla.suse.com/967969"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968004 for CVE-2016-2538",
          "url": "https://bugzilla.suse.com/968004"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Desktop 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.4_02-22.19.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.4_02-22.19.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-05-17T12:09:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-2538"
    }
  ]
}

CVE-2015-8568 (GCVE-0-2015-8568)

Vulnerability from cvelistv5

Published

2017-04-11 19:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.

References

►

URL

Tags

	http://www.securityfocus.com/bid/79721	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2015/12/15/10	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=1289816	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.690Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "79721",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79721"
          },
          {
            "name": "[oss-security] 20151215 Re: CVE request Qemu: net: vmxnet3: host memory leakage",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/15/10"
          },
          {
            "name": "[qemu-devel] 20151215 Re: [Qemu-devel] net: vmxnet3: memory leakage issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1289816"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "79721",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79721"
        },
        {
          "name": "[oss-security] 20151215 Re: CVE request Qemu: net: vmxnet3: host memory leakage",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/15/10"
        },
        {
          "name": "[qemu-devel] 20151215 Re: [Qemu-devel] net: vmxnet3: memory leakage issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1289816"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8568",
    "datePublished": "2017-04-11T19:00:00",
    "dateReserved": "2015-12-15T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1571 (GCVE-0-2016-1571)

Vulnerability from cvelistv5

Published

2016-01-22 15:00

Modified

2024-08-05 23:02

Severity ?

CWE

Summary

The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

References

►

URL

Tags

	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://www.securitytracker.com/id/1034745	vdb-entry, x_refsource_SECTRACK
	http://support.citrix.com/article/CTX205496	x_refsource_CONFIRM
	http://xenbits.xen.org/xsa/advisory-168.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:02:11.683Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "1034745",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034745"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX205496"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-168.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-30T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "1034745",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034745"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX205496"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-168.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-1571",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "1034745",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034745"
            },
            {
              "name": "http://support.citrix.com/article/CTX205496",
              "refsource": "CONFIRM",
              "url": "http://support.citrix.com/article/CTX205496"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-168.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-168.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-1571",
    "datePublished": "2016-01-22T15:00:00",
    "dateReserved": "2016-01-11T00:00:00",
    "dateUpdated": "2024-08-05T23:02:11.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4538 (GCVE-0-2013-4538)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead7a57df37d2187813a121308213f41591bd811	x_refsource_CONFIRM
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:15.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead7a57df37d2187813a121308213f41591bd811"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead7a57df37d2187813a121308213f41591bd811"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4538",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:15.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8567 (GCVE-0-2015-8567)

Vulnerability from cvelistv5

Published

2017-04-13 17:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).

References

►

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/79721	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00058.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00012.html	vendor-advisory, x_refsource_SUSE
	http://www.ubuntu.com/usn/USN-2891-1	vendor-advisory, x_refsource_UBUNTU
	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00010.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176558.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2015/12/15/10	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176300.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00049.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176503.html	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2016:1560",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00017.html"
          },
          {
            "name": "79721",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79721"
          },
          {
            "name": "SUSE-SU-2016:1703",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2016:0126",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00012.html"
          },
          {
            "name": "USN-2891-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2891-1"
          },
          {
            "name": "openSUSE-SU-2016:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00010.html"
          },
          {
            "name": "FEDORA-2016-275e9ff483",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176558.html"
          },
          {
            "name": "FEDORA-2016-42778e8c82",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html"
          },
          {
            "name": "[oss-security] 20151215 Re: CVE request Qemu: net: vmxnet3: host memory leakage",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/15/10"
          },
          {
            "name": "SUSE-SU-2016:0955",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00002.html"
          },
          {
            "name": "[qemu-devel] 20151215 Re: [Qemu-devel] net: vmxnet3: memory leakage issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html"
          },
          {
            "name": "FEDORA-2016-2c15b72b01",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176300.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "SUSE-SU-2016:1318",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00049.html"
          },
          {
            "name": "SUSE-SU-2016:0873",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.html"
          },
          {
            "name": "FEDORA-2016-e1784417af",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176503.html"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "name": "openSUSE-SU-2016:1750",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-13T16:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2016:1560",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00017.html"
        },
        {
          "name": "79721",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79721"
        },
        {
          "name": "SUSE-SU-2016:1703",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2016:0126",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00012.html"
        },
        {
          "name": "USN-2891-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2891-1"
        },
        {
          "name": "openSUSE-SU-2016:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00010.html"
        },
        {
          "name": "FEDORA-2016-275e9ff483",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176558.html"
        },
        {
          "name": "FEDORA-2016-42778e8c82",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175967.html"
        },
        {
          "name": "[oss-security] 20151215 Re: CVE request Qemu: net: vmxnet3: host memory leakage",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/15/10"
        },
        {
          "name": "SUSE-SU-2016:0955",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00002.html"
        },
        {
          "name": "[qemu-devel] 20151215 Re: [Qemu-devel] net: vmxnet3: memory leakage issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html"
        },
        {
          "name": "FEDORA-2016-2c15b72b01",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176300.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "SUSE-SU-2016:1318",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00049.html"
        },
        {
          "name": "SUSE-SU-2016:0873",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00087.html"
        },
        {
          "name": "FEDORA-2016-e1784417af",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176503.html"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "name": "openSUSE-SU-2016:1750",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00003.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8567",
    "datePublished": "2017-04-13T17:00:00",
    "dateReserved": "2015-12-15T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8504 (GCVE-0-2015-8504)

Vulnerability from cvelistv5

Published

2017-04-11 19:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1289541	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2015/12/08/7	mailing-list, x_refsource_MLIST
	http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=4c65fed8bdf96780735dbdb92a8	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/78708	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:42.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1289541"
          },
          {
            "name": "[oss-security] 20151208 Re: CVE request: Qemu: ui: vnc: avoid floating point exception",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/08/7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=4c65fed8bdf96780735dbdb92a8"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "name": "78708",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78708"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1289541"
        },
        {
          "name": "[oss-security] 20151208 Re: CVE request: Qemu: ui: vnc: avoid floating point exception",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/08/7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=4c65fed8bdf96780735dbdb92a8"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "name": "78708",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78708"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8504",
    "datePublished": "2017-04-11T19:00:00",
    "dateReserved": "2015-12-08T00:00:00",
    "dateUpdated": "2024-08-06T08:20:42.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7549 (GCVE-0-2015-7549)

Vulnerability from cvelistv5

Published

2017-10-30 14:00

Modified

2024-08-06 07:51

Severity ?

CWE

Summary

The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2015/12/14/2	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/80761	vdb-entry, x_refsource_BID
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=1291137	x_refsource_CONFIRM
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151214 CVE-2015-7549 Qemu: pci: msi-x: null pointer dereference issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/14/2"
          },
          {
            "name": "80761",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/80761"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1291137"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "name": "FEDORA-2016-e9bba2bb01",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20151214 CVE-2015-7549 Qemu: pci: msi-x: null pointer dereference issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/14/2"
        },
        {
          "name": "80761",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/80761"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1291137"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "name": "FEDORA-2016-e9bba2bb01",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-7549",
    "datePublished": "2017-10-30T14:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:28.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1779 (GCVE-0-2015-1779)

Vulnerability from cvelistv5

Published

2016-01-12 19:00

Modified

2024-08-06 04:54

Severity ?

CWE

Summary

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

References

►

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html	vendor-advisory, x_refsource_SUSE
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2015/dsa-3259	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2015/04/09/6	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html	vendor-advisory, x_refsource_FEDORA
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2015-1931.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2015/03/24/9	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1033975	vdb-entry, x_refsource_SECTRACK
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2015-1943.html	vendor-advisory, x_refsource_REDHAT
	http://www.ubuntu.com/usn/USN-2608-1	vendor-advisory, x_refsource_UBUNTU
	https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/73303	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:15.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2015:0870",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html"
          },
          {
            "name": "FEDORA-2015-5541",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html"
          },
          {
            "name": "DSA-3259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3259"
          },
          {
            "name": "[oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/04/09/6"
          },
          {
            "name": "SUSE-SU-2015:0896",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
          },
          {
            "name": "FEDORA-2015-5482",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html"
          },
          {
            "name": "RHSA-2015:1931",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1931.html"
          },
          {
            "name": "[oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/03/24/9"
          },
          {
            "name": "1033975",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1033975"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
          },
          {
            "name": "RHSA-2015:1943",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1943.html"
          },
          {
            "name": "USN-2608-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2608-1"
          },
          {
            "name": "[Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html"
          },
          {
            "name": "73303",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/73303"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2015:0870",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00033.html"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04896.html"
        },
        {
          "name": "FEDORA-2015-5541",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155196.html"
        },
        {
          "name": "DSA-3259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3259"
        },
        {
          "name": "[oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/04/09/6"
        },
        {
          "name": "SUSE-SU-2015:0896",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html"
        },
        {
          "name": "FEDORA-2015-5482",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html"
        },
        {
          "name": "RHSA-2015:1931",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1931.html"
        },
        {
          "name": "[oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/03/24/9"
        },
        {
          "name": "1033975",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1033975"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
        },
        {
          "name": "RHSA-2015:1943",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1943.html"
        },
        {
          "name": "USN-2608-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2608-1"
        },
        {
          "name": "[Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html"
        },
        {
          "name": "73303",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/73303"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1779",
    "datePublished": "2016-01-12T19:00:00",
    "dateReserved": "2015-02-17T00:00:00",
    "dateUpdated": "2024-08-06T04:54:15.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1568 (GCVE-0-2016-1568)

Vulnerability from cvelistv5

Published

2016-04-08 16:00

Modified

2024-08-05 23:02

Severity ?

CWE

Summary

Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.

References

►

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2016-0086.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2016/01/09/2	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/80191	vdb-entry, x_refsource_BID
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1034859	vdb-entry, x_refsource_SECTRACK
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2016-0087.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-0084.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	http://rhn.redhat.com/errata/RHSA-2016-0088.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2016/01/09/1	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:02:11.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0086.html"
          },
          {
            "name": "[oss-security] 20160109 Re: Qemu: ide: ahci use-after-free vulnerability in aio port commands",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/09/2"
          },
          {
            "name": "80191",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/80191"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab"
          },
          {
            "name": "1034859",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034859"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "RHSA-2016:0087",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0087.html"
          },
          {
            "name": "RHSA-2016:0084",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0084.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "name": "RHSA-2016:0088",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0088.html"
          },
          {
            "name": "[oss-security] 20160109 Qemu: ide: ahci use-after-free vulnerability in aio port commands",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/09/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0086.html"
        },
        {
          "name": "[oss-security] 20160109 Re: Qemu: ide: ahci use-after-free vulnerability in aio port commands",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/09/2"
        },
        {
          "name": "80191",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/80191"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab"
        },
        {
          "name": "1034859",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034859"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "RHSA-2016:0087",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0087.html"
        },
        {
          "name": "RHSA-2016:0084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0084.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "name": "RHSA-2016:0088",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0088.html"
        },
        {
          "name": "[oss-security] 20160109 Qemu: ide: ahci use-after-free vulnerability in aio port commands",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/09/1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-1568",
    "datePublished": "2016-04-08T16:00:00",
    "dateReserved": "2016-01-09T00:00:00",
    "dateUpdated": "2024-08-05T23:02:11.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8744 (GCVE-0-2015-8744)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-06 08:29

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1270871	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/79821	vdb-entry, x_refsource_BID
	http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a7278b36fcab9af469563bd7b	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/01/04/3	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/01/04/6	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	http://www.securitytracker.com/id/1034576	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:21.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1270871"
          },
          {
            "name": "79821",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79821"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a7278b36fcab9af469563bd7b"
          },
          {
            "name": "[oss-security] 20160104 CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/3"
          },
          {
            "name": "[oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/6"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "1034576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034576"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1270871"
        },
        {
          "name": "79821",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79821"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a7278b36fcab9af469563bd7b"
        },
        {
          "name": "[oss-security] 20160104 CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/3"
        },
        {
          "name": "[oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/6"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "1034576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034576"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8744",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-04T00:00:00",
    "dateUpdated": "2024-08-06T08:29:21.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4529 (GCVE-0-2013-4529)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2014-0927.html	vendor-advisory, x_refsource_REDHAT
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:15.104Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "RHSA-2014:0927",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0927.html"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "RHSA-2014:0927",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0927.html"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4529",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:15.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8817 (GCVE-0-2015-8817)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-06 08:29

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.

References

►

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2016-2671.html	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=1300771	x_refsource_CONFIRM
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=23820dbfc79d1c9dce090b4c555994f2bb6a69b3	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2016-2706.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2016/03/01/1	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/03/01/10	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-2705.html	vendor-advisory, x_refsource_REDHAT
	https://lists.gnu.org/archive/html/qemu-stable/2016-01/msg00060.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-2670.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-2704.html	vendor-advisory, x_refsource_REDHAT
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c3c1bb99d1c11978d9ce94d1bdcf0705378c1459	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:22.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:2671",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2671.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1300771"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=23820dbfc79d1c9dce090b4c555994f2bb6a69b3"
          },
          {
            "name": "RHSA-2016:2706",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2706.html"
          },
          {
            "name": "[oss-security] 20160301 CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/01/1"
          },
          {
            "name": "[oss-security] 20160301 Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/01/10"
          },
          {
            "name": "RHSA-2016:2705",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2705.html"
          },
          {
            "name": "[qemu-stable] 20160127 [PATCH for v2.3.1] exec: Respect as_translate_internal length clamp",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-stable/2016-01/msg00060.html"
          },
          {
            "name": "RHSA-2016:2670",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2670.html"
          },
          {
            "name": "RHSA-2016:2704",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2704.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c3c1bb99d1c11978d9ce94d1bdcf0705378c1459"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built to use \u0027address_space_translate\u0027 to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions \u003e= 1.6.0 and \u003c= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:2671",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2671.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1300771"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=23820dbfc79d1c9dce090b4c555994f2bb6a69b3"
        },
        {
          "name": "RHSA-2016:2706",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2706.html"
        },
        {
          "name": "[oss-security] 20160301 CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/01/1"
        },
        {
          "name": "[oss-security] 20160301 Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/01/10"
        },
        {
          "name": "RHSA-2016:2705",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2705.html"
        },
        {
          "name": "[qemu-stable] 20160127 [PATCH for v2.3.1] exec: Respect as_translate_internal length clamp",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-stable/2016-01/msg00060.html"
        },
        {
          "name": "RHSA-2016:2670",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2670.html"
        },
        {
          "name": "RHSA-2016:2704",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2704.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c3c1bb99d1c11978d9ce94d1bdcf0705378c1459"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8817",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-03-01T00:00:00",
    "dateUpdated": "2024-08-06T08:29:22.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-7815 (GCVE-0-2014-7815)

Vulnerability from cvelistv5

Published

2014-11-14 15:00

Modified

2024-08-06 13:03

Severity ?

CWE

Summary

The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.

References

►

URL

Tags

	http://secunia.com/advisories/61484	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2015-0624.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/62144	third-party-advisory, x_refsource_SECUNIA
	https://bugzilla.redhat.com/show_bug.cgi?id=1157641	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/62143	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2015-0349.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2014/dsa-3067	vendor-advisory, x_refsource_DEBIAN
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829	x_refsource_CONFIRM
	http://support.citrix.com/article/CTX200892	x_refsource_CONFIRM
	http://www.ubuntu.com/usn/USN-2409-1	vendor-advisory, x_refsource_UBUNTU
	http://www.debian.org/security/2014/dsa-3066	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:03:27.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "61484",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61484"
          },
          {
            "name": "RHSA-2015:0624",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0624.html"
          },
          {
            "name": "62144",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62144"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157641"
          },
          {
            "name": "SUSE-SU-2015:1782",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
          },
          {
            "name": "62143",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62143"
          },
          {
            "name": "RHSA-2015:0349",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0349.html"
          },
          {
            "name": "DSA-3067",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3067"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX200892"
          },
          {
            "name": "USN-2409-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2409-1"
          },
          {
            "name": "DSA-3066",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3066"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-27T17:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "61484",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61484"
        },
        {
          "name": "RHSA-2015:0624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0624.html"
        },
        {
          "name": "62144",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62144"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157641"
        },
        {
          "name": "SUSE-SU-2015:1782",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
        },
        {
          "name": "62143",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62143"
        },
        {
          "name": "RHSA-2015:0349",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0349.html"
        },
        {
          "name": "DSA-3067",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3067"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX200892"
        },
        {
          "name": "USN-2409-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2409-1"
        },
        {
          "name": "DSA-3066",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3066"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-7815",
    "datePublished": "2014-11-14T15:00:00",
    "dateReserved": "2014-10-03T00:00:00",
    "dateUpdated": "2024-08-06T13:03:27.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8745 (GCVE-0-2015-8745)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-06 08:29

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.

References

►

URL

Tags

	http://www.securitytracker.com/id/1034575	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/79822	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2016/01/04/7	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/01/04/4	mailing-list, x_refsource_MLIST
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c6048f849c7e3f009786df76206e895	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=1270876	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:21.574Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1034575",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034575"
          },
          {
            "name": "79822",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79822"
          },
          {
            "name": "[oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/7"
          },
          {
            "name": "[oss-security] 20160104 CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c6048f849c7e3f009786df76206e895"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1270876"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-10-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1034575",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034575"
        },
        {
          "name": "79822",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79822"
        },
        {
          "name": "[oss-security] 20160104 Re: CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/7"
        },
        {
          "name": "[oss-security] 20160104 CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c6048f849c7e3f009786df76206e895"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1270876"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8745",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-04T00:00:00",
    "dateUpdated": "2024-08-06T08:29:21.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-5278 (GCVE-0-2015-5278)

Vulnerability from cvelistv5

Published

2020-01-23 19:40

Modified

2024-08-06 06:41

Severity ?

CWE

Other

Summary

The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

References

►

URL

Tags

	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html	x_refsource_MISC
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html	x_refsource_MISC
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html	x_refsource_MISC
	http://www.ubuntu.com/usn/USN-2745-1	x_refsource_MISC
	https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html	x_refsource_MISC
	https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03985.html	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2015/09/15/2	x_refsource_MISC
	https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	QEMU	QEMU	Version: before 2.4.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T06:41:09.527Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2745-1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03985.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/09/15/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QEMU",
          "vendor": "QEMU",
          "versions": [
            {
              "status": "affected",
              "version": "before 2.4.0.1"
            }
          ]
        }
      ],
      "datePublic": "2015-09-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-05T17:03:31",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2745-1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03985.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/09/15/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-5278",
    "datePublished": "2020-01-23T19:40:18",
    "dateReserved": "2015-07-01T00:00:00",
    "dateUpdated": "2024-08-06T06:41:09.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1714 (GCVE-0-2016-1714)

Vulnerability from cvelistv5

Published

2016-04-07 19:00

Modified

2024-08-05 23:02

Severity ?

CWE

Summary

The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/01/12/10	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-0083.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-0085.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-0086.html	vendor-advisory, x_refsource_REDHAT
	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/01/12/11	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/01/11/7	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1034858	vdb-entry, x_refsource_SECTRACK
	https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-0081.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/80250	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2016-0082.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-0087.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-0084.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2016-0088.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:02:12.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/12/10"
          },
          {
            "name": "RHSA-2016:0083",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0083.html"
          },
          {
            "name": "RHSA-2016:0085",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0085.html"
          },
          {
            "name": "RHSA-2016:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0086.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "name": "[oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/12/11"
          },
          {
            "name": "[oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/11/7"
          },
          {
            "name": "1034858",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034858"
          },
          {
            "name": "[Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html"
          },
          {
            "name": "RHSA-2016:0081",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0081.html"
          },
          {
            "name": "80250",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/80250"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "RHSA-2016:0082",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0082.html"
          },
          {
            "name": "RHSA-2016:0087",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0087.html"
          },
          {
            "name": "RHSA-2016:0084",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0084.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "RHSA-2016:0088",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0088.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/12/10"
        },
        {
          "name": "RHSA-2016:0083",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0083.html"
        },
        {
          "name": "RHSA-2016:0085",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0085.html"
        },
        {
          "name": "RHSA-2016:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0086.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "name": "[oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/12/11"
        },
        {
          "name": "[oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/11/7"
        },
        {
          "name": "1034858",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034858"
        },
        {
          "name": "[Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html"
        },
        {
          "name": "RHSA-2016:0081",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0081.html"
        },
        {
          "name": "80250",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/80250"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "RHSA-2016:0082",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0082.html"
        },
        {
          "name": "RHSA-2016:0087",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0087.html"
        },
        {
          "name": "RHSA-2016:0084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0084.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "RHSA-2016:0088",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0088.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-1714",
    "datePublished": "2016-04-07T19:00:00",
    "dateReserved": "2016-01-12T00:00:00",
    "dateUpdated": "2024-08-05T23:02:12.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-0222 (GCVE-0-2014-0222)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 09:05

Severity ?

CWE

Summary

Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.

References

►

URL

Tags

	https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html	vendor-advisory, x_refsource_SUSE
	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/67357	vdb-entry, x_refsource_BID
	http://www.debian.org/security/2014/dsa-3044	vendor-advisory, x_refsource_DEBIAN
	http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:05:39.217Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html"
          },
          {
            "name": "SUSE-SU-2015:0929",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html"
          },
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "67357",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/67357"
          },
          {
            "name": "DSA-3044",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3044"
          },
          {
            "name": "openSUSE-SU-2015:1965",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html"
          },
          {
            "name": "FEDORA-2014-6970",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-05-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-devel] 20140512 [PATCH 3/5] qcow1: Validate L2 table size (CVE-2014-0222)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html"
        },
        {
          "name": "SUSE-SU-2015:0929",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html"
        },
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "67357",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/67357"
        },
        {
          "name": "DSA-3044",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3044"
        },
        {
          "name": "openSUSE-SU-2015:1965",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html"
        },
        {
          "name": "FEDORA-2014-6970",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-0222",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-12-03T00:00:00",
    "dateUpdated": "2024-08-06T09:05:39.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1922 (GCVE-0-2016-1922)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-05 23:10

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/01/16/1	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://www.openwall.com/lists/oss-security/2016/01/16/6	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg02812.html	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/81058	vdb-entry, x_refsource_BID
	https://bugzilla.redhat.com/show_bug.cgi?id=1283934	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:10:40.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20160116 CVE request Qemu: i386: null pointer dereference in vapic_write",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/16/1"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "[oss-security] 20160116 Re: CVE request Qemu: i386: null pointer dereference in vapic_write",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/16/6"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "[qemu-devel] 20160115 [PULL] i386: avoid null pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg02812.html"
          },
          {
            "name": "81058",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81058"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283934"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, \u0027current_cpu\u0027 remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20160116 CVE request Qemu: i386: null pointer dereference in vapic_write",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/16/1"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "[oss-security] 20160116 Re: CVE request Qemu: i386: null pointer dereference in vapic_write",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/16/6"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "[qemu-devel] 20160115 [PULL] i386: avoid null pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg02812.html"
        },
        {
          "name": "81058",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81058"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283934"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-1922",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-16T00:00:00",
    "dateUpdated": "2024-08-05T23:10:40.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3689 (GCVE-0-2014-3689)

Vulnerability from cvelistv5

Published

2014-11-14 15:00

Modified

2024-08-06 10:50

Severity ?

CWE

Summary

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

References

►

URL

Tags

	http://secunia.com/advisories/62144	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/62143	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2014/dsa-3067	vendor-advisory, x_refsource_DEBIAN
	https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html	mailing-list, x_refsource_MLIST
	http://www.ubuntu.com/usn/USN-2409-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/60923	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2014/dsa-3066	vendor-advisory, x_refsource_DEBIAN
	http://www.osvdb.org/114397	vdb-entry, x_refsource_OSVDB

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:17.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62144",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62144"
          },
          {
            "name": "62143",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62143"
          },
          {
            "name": "DSA-3067",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3067"
          },
          {
            "name": "[Qemu-devel] 20141015 [PATCH v2 0/5] vmware-vga: fix CVE-2014-3689",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html"
          },
          {
            "name": "USN-2409-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2409-1"
          },
          {
            "name": "60923",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60923"
          },
          {
            "name": "DSA-3066",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3066"
          },
          {
            "name": "114397",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/114397"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-14T14:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "62144",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62144"
        },
        {
          "name": "62143",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62143"
        },
        {
          "name": "DSA-3067",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3067"
        },
        {
          "name": "[Qemu-devel] 20141015 [PATCH v2 0/5] vmware-vga: fix CVE-2014-3689",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://www.mail-archive.com/qemu-devel%40nongnu.org/msg261580.html"
        },
        {
          "name": "USN-2409-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2409-1"
        },
        {
          "name": "60923",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60923"
        },
        {
          "name": "DSA-3066",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3066"
        },
        {
          "name": "114397",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/114397"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3689",
    "datePublished": "2014-11-14T15:00:00",
    "dateReserved": "2014-05-14T00:00:00",
    "dateUpdated": "2024-08-06T10:50:17.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8555 (GCVE-0-2015-8555)

Vulnerability from cvelistv5

Published

2016-04-13 15:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

References

►

URL

Tags

	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://www.securitytracker.com/id/1034477	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/79543	vdb-entry, x_refsource_BID
	http://xenbits.xen.org/xsa/advisory-165.html	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO
	http://support.citrix.com/article/CTX203879	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.162Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
          },
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "1034477",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034477"
          },
          {
            "name": "79543",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79543"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-165.html"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX203879"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
        },
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "1034477",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034477"
        },
        {
          "name": "79543",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79543"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-165.html"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX203879"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8555",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
            },
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "1034477",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034477"
            },
            {
              "name": "79543",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/79543"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-165.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-165.html"
            },
            {
              "name": "GLSA-201604-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201604-03"
            },
            {
              "name": "http://support.citrix.com/article/CTX203879",
              "refsource": "CONFIRM",
              "url": "http://support.citrix.com/article/CTX203879"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8555",
    "datePublished": "2016-04-13T15:00:00",
    "dateReserved": "2015-12-14T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8743 (GCVE-0-2015-8743)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-06 08:29

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/01/04/2	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1264929	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1034574	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/79820	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2016/01/04/1	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00050.html	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:21.247Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20160104 Re: CVE request Qemu: net: ne2000: OOB r/w in ioport operations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264929"
          },
          {
            "name": "1034574",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034574"
          },
          {
            "name": "79820",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79820"
          },
          {
            "name": "[oss-security] 20160104 CVE request Qemu: net: ne2000: OOB r/w in ioport operations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/04/1"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "[qemu-devel] 20160104 Re: [PATCH v3] net: ne2000: fix bounds check in ioport operations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00050.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing \u0027ioport\u0027 r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20160104 Re: CVE request Qemu: net: ne2000: OOB r/w in ioport operations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1264929"
        },
        {
          "name": "1034574",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034574"
        },
        {
          "name": "79820",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79820"
        },
        {
          "name": "[oss-security] 20160104 CVE request Qemu: net: ne2000: OOB r/w in ioport operations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/04/1"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "[qemu-devel] 20160104 Re: [PATCH v3] net: ne2000: fix bounds check in ioport operations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00050.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8743",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-04T00:00:00",
    "dateUpdated": "2024-08-06T08:29:21.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2271 (GCVE-0-2016-2271)

Vulnerability from cvelistv5

Published

2016-02-19 16:00

Modified

2024-08-05 23:24

Severity ?

CWE

Summary

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

References

►

URL

Tags

	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html	vendor-advisory, x_refsource_FEDORA
	http://www.securitytracker.com/id/1035043	vdb-entry, x_refsource_SECTRACK
	http://xenbits.xen.org/xsa/advisory-170.html	x_refsource_CONFIRM
	http://support.citrix.com/article/CTX209443	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:24:48.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "FEDORA-2016-e48f4bd14f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
          },
          {
            "name": "FEDORA-2016-f8121efdac",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
          },
          {
            "name": "1035043",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035043"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-170.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX209443"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "FEDORA-2016-e48f4bd14f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
        },
        {
          "name": "FEDORA-2016-f8121efdac",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
        },
        {
          "name": "1035043",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035043"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-170.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX209443"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-2271",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "FEDORA-2016-e48f4bd14f",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
            },
            {
              "name": "FEDORA-2016-f8121efdac",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
            },
            {
              "name": "1035043",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035043"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-170.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-170.html"
            },
            {
              "name": "http://support.citrix.com/article/CTX209443",
              "refsource": "CONFIRM",
              "url": "http://support.citrix.com/article/CTX209443"
            },
            {
              "name": "GLSA-201604-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201604-03"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-2271",
    "datePublished": "2016-02-19T16:00:00",
    "dateReserved": "2016-02-09T00:00:00",
    "dateUpdated": "2024-08-05T23:24:48.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2270 (GCVE-0-2016-2270)

Vulnerability from cvelistv5

Published

2016-02-19 16:00

Modified

2024-08-05 23:24

Severity ?

CWE

Summary

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

References

►

URL

Tags

	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html	vendor-advisory, x_refsource_FEDORA
	http://xenbits.xen.org/xsa/advisory-154.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1035042	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:24:48.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
          },
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "FEDORA-2016-e48f4bd14f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
          },
          {
            "name": "FEDORA-2016-f8121efdac",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-154.html"
          },
          {
            "name": "1035042",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035042"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
        },
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "FEDORA-2016-e48f4bd14f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
        },
        {
          "name": "FEDORA-2016-f8121efdac",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-154.html"
        },
        {
          "name": "1035042",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035042"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-2270",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
            },
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "FEDORA-2016-e48f4bd14f",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html"
            },
            {
              "name": "FEDORA-2016-f8121efdac",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-154.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-154.html"
            },
            {
              "name": "1035042",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035042"
            },
            {
              "name": "GLSA-201604-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201604-03"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-2270",
    "datePublished": "2016-02-19T16:00:00",
    "dateReserved": "2016-02-09T00:00:00",
    "dateUpdated": "2024-08-05T23:24:48.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9718 (GCVE-0-2014-9718)

Vulnerability from cvelistv5

Published

2015-04-21 16:00

Modified

2024-08-06 13:55

Severity ?

CWE

Summary

The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.

References

►

URL

Tags

	http://www.debian.org/security/2015/dsa-3259	vendor-advisory, x_refsource_DEBIAN
	http://openwall.com/lists/oss-security/2015/04/20/7	mailing-list, x_refsource_MLIST
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/73316	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:55:04.598Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3259",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3259"
          },
          {
            "name": "[oss-security] 20150420 Re: CVE request Qemu: malicious PRDT flow from guest to host",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2015/04/20/7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8"
          },
          {
            "name": "73316",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/73316"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function\u0027s return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-15T15:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-3259",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3259"
        },
        {
          "name": "[oss-security] 20150420 Re: CVE request Qemu: malicious PRDT flow from guest to host",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2015/04/20/7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8"
        },
        {
          "name": "73316",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/73316"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-9718",
    "datePublished": "2015-04-21T16:00:00",
    "dateReserved": "2015-04-21T00:00:00",
    "dateUpdated": "2024-08-06T13:55:04.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1981 (GCVE-0-2016-1981)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-05 23:17

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

References

►

URL

Tags

	https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2016/01/19/10	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1298570	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/01/22/1	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-2585.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/81549	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qemu-devel] 20160119 [PATCH] e1000: eliminate infinite loops on out-of-bounds transfer start",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "[oss-security] 20160119 CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/19/10"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1298570"
          },
          {
            "name": "[oss-security] 20160122 Re: CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/22/1"
          },
          {
            "name": "RHSA-2016:2585",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2585.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "81549",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/81549"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[qemu-devel] 20160119 [PATCH] e1000: eliminate infinite loops on out-of-bounds transfer start",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "[oss-security] 20160119 CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/19/10"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1298570"
        },
        {
          "name": "[oss-security] 20160122 Re: CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/22/1"
        },
        {
          "name": "RHSA-2016:2585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2585.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "81549",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/81549"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-1981",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-21T00:00:00",
    "dateUpdated": "2024-08-05T23:17:50.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4530 (GCVE-0-2013-4530)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA
	http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=d8d0a0bc7e194300e53a346d25fe5724fd588387	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:15.229Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=d8d0a0bc7e194300e53a346d25fe5724fd588387"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=d8d0a0bc7e194300e53a346d25fe5724fd588387"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4530",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:15.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8613 (GCVE-0-2015-8613)

Vulnerability from cvelistv5

Published

2017-04-11 19:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2015/12/22/1	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/79719	vdb-entry, x_refsource_BID
	https://bugzilla.redhat.com/show_bug.cgi?id=1284008	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.558Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151221 Re: CVE request: Qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/22/1"
          },
          {
            "name": "79719",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79719"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1284008"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "[qemu-devel] 20151221 [Qemu-devel] [PATCH] scsi: initialise info object with appropriate size",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20151221 Re: CVE request: Qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/22/1"
        },
        {
          "name": "79719",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79719"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1284008"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "[qemu-devel] 20151221 [Qemu-devel] [PATCH] scsi: initialise info object with appropriate size",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8613",
    "datePublished": "2017-04-11T19:00:00",
    "dateReserved": "2015-12-21T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1570 (GCVE-0-2016-1570)

Vulnerability from cvelistv5

Published

2016-01-22 15:00

Modified

2024-08-05 23:02

Severity ?

CWE

Summary

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

References

►

URL

Tags

	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://www.securitytracker.com/id/1034744	vdb-entry, x_refsource_SECTRACK
	http://xenbits.xen.org/xsa/advisory-167.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:02:11.689Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "1034744",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034744"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-167.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-30T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "1034744",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034744"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-167.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-1570",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "1034744",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034744"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-167.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-167.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-1570",
    "datePublished": "2016-01-22T15:00:00",
    "dateReserved": "2016-01-11T00:00:00",
    "dateUpdated": "2024-08-05T23:02:11.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2391 (GCVE-0-2016-2391)

Vulnerability from cvelistv5

Published

2016-06-16 18:00

Modified

2024-08-05 23:24

Severity ?

CWE

Summary

The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.

References

►

URL

Tags

	http://www.securityfocus.com/bid/83263	vdb-entry, x_refsource_BID
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/02/16/2	mailing-list, x_refsource_MLIST
	http://www.ubuntu.com/usn/USN-2974-1	vendor-advisory, x_refsource_UBUNTU
	https://bugzilla.redhat.com/show_bug.cgi?id=1304794	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:24:49.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "83263",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/83263"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360"
          },
          {
            "name": "[oss-security] 20160216 CVE request Qemu: usb: multiple eof_timers in ohci leads to null pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/02/16/2"
          },
          {
            "name": "USN-2974-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2974-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304794"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "[qemu-devel] 20160216 [Qemu-devel] [PATCH] usb: ohci avoid multiple eof timers",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "83263",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/83263"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360"
        },
        {
          "name": "[oss-security] 20160216 CVE request Qemu: usb: multiple eof_timers in ohci leads to null pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/02/16/2"
        },
        {
          "name": "USN-2974-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2974-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304794"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "[qemu-devel] 20160216 [Qemu-devel] [PATCH] usb: ohci avoid multiple eof timers",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2391",
    "datePublished": "2016-06-16T18:00:00",
    "dateReserved": "2016-02-16T00:00:00",
    "dateUpdated": "2024-08-05T23:24:49.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2392 (GCVE-0-2016-2392)

Vulnerability from cvelistv5

Published

2016-06-16 18:00

Modified

2024-08-05 23:24

Severity ?

CWE

Summary

The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.

References

►

URL

Tags

	http://www.securityfocus.com/bid/83274	vdb-entry, x_refsource_BID
	https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/02/16/7	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://www.ubuntu.com/usn/USN-2974-1	vendor-advisory, x_refsource_UBUNTU
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=80eecda8e5d09c442c24307f340840a5b70ea3b9	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=1302299	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:24:49.312Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "83274",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/83274"
          },
          {
            "name": "[qemu-devel] 20160211 [Qemu-devel] [PATCH] usb: check USB configuration descriptor object",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html"
          },
          {
            "name": "[oss-security] 20160216 CVE request Qemu: usb: null pointer dereference in remote NDIS control message handling",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/02/16/7"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "USN-2974-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2974-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=80eecda8e5d09c442c24307f340840a5b70ea3b9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302299"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "[qemu-stable] 20160329 [Qemu-stable] [ANNOUNCE] QEMU 2.5.1 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "83274",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/83274"
        },
        {
          "name": "[qemu-devel] 20160211 [Qemu-devel] [PATCH] usb: check USB configuration descriptor object",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html"
        },
        {
          "name": "[oss-security] 20160216 CVE request Qemu: usb: null pointer dereference in remote NDIS control message handling",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/02/16/7"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "USN-2974-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2974-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=80eecda8e5d09c442c24307f340840a5b70ea3b9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302299"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "[qemu-stable] 20160329 [Qemu-stable] [ANNOUNCE] QEMU 2.5.1 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2392",
    "datePublished": "2016-06-16T18:00:00",
    "dateReserved": "2016-02-16T00:00:00",
    "dateUpdated": "2024-08-05T23:24:49.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8818 (GCVE-0-2015-8818)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-06 08:29

Severity ?

CWE

Summary

The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.

References

►

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2016-2671.html	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=1300771	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2016-2706.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2016/03/01/1	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2016/03/01/10	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-2705.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2016-2670.html	vendor-advisory, x_refsource_REDHAT
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b242e0e0e2969c044a318e56f7988bbd84de1f63	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2016-2704.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:22.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:2671",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2671.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1300771"
          },
          {
            "name": "RHSA-2016:2706",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2706.html"
          },
          {
            "name": "[oss-security] 20160301 CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/01/1"
          },
          {
            "name": "[oss-security] 20160301 Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/01/10"
          },
          {
            "name": "RHSA-2016:2705",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2705.html"
          },
          {
            "name": "RHSA-2016:2670",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2670.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b242e0e0e2969c044a318e56f7988bbd84de1f63"
          },
          {
            "name": "RHSA-2016:2704",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2704.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-07-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:2671",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2671.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1300771"
        },
        {
          "name": "RHSA-2016:2706",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2706.html"
        },
        {
          "name": "[oss-security] 20160301 CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/01/1"
        },
        {
          "name": "[oss-security] 20160301 Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/01/10"
        },
        {
          "name": "RHSA-2016:2705",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2705.html"
        },
        {
          "name": "RHSA-2016:2670",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2670.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b242e0e0e2969c044a318e56f7988bbd84de1f63"
        },
        {
          "name": "RHSA-2016:2704",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2704.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8818",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-03-01T00:00:00",
    "dateUpdated": "2024-08-06T08:29:22.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4537 (GCVE-0-2013-4537)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a9c380db3b8c6af19546a68145c8d1438a09c92b	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:14.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a9c380db3b8c6af19546a68145c8d1438a09c92b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a9c380db3b8c6af19546a68145c8d1438a09c92b"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4537",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:14.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4533 (GCVE-0-2013-4533)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=caa881abe0e01f9931125a0977ec33c5343e4aa7	x_refsource_CONFIRM
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:14.818Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=caa881abe0e01f9931125a0977ec33c5343e4aa7"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s-\u003erx_level value in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=caa881abe0e01f9931125a0977ec33c5343e4aa7"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4533",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:14.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8550 (GCVE-0-2015-8550)

Vulnerability from cvelistv5

Published

2016-04-14 14:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.

References

►

URL

Tags

	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3519	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/79592	vdb-entry, x_refsource_BID
	http://xenbits.xen.org/xsa/advisory-155.html	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html	vendor-advisory, x_refsource_SUSE
	http://www.securitytracker.com/id/1034479	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3434	vendor-advisory, x_refsource_DEBIAN
	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.458Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
          },
          {
            "name": "DSA-3519",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3519"
          },
          {
            "name": "79592",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79592"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-155.html"
          },
          {
            "name": "SUSE-SU-2016:1764",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html"
          },
          {
            "name": "SUSE-SU-2016:1102",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html"
          },
          {
            "name": "1034479",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034479"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "DSA-3434",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3434"
          },
          {
            "name": "SUSE-SU-2016:0911",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
        },
        {
          "name": "DSA-3519",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3519"
        },
        {
          "name": "79592",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79592"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-155.html"
        },
        {
          "name": "SUSE-SU-2016:1764",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html"
        },
        {
          "name": "SUSE-SU-2016:1102",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html"
        },
        {
          "name": "1034479",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034479"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "DSA-3434",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3434"
        },
        {
          "name": "SUSE-SU-2016:0911",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8550",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
            },
            {
              "name": "DSA-3519",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3519"
            },
            {
              "name": "79592",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/79592"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-155.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-155.html"
            },
            {
              "name": "SUSE-SU-2016:1764",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html"
            },
            {
              "name": "SUSE-SU-2016:1102",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html"
            },
            {
              "name": "1034479",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034479"
            },
            {
              "name": "GLSA-201604-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201604-03"
            },
            {
              "name": "DSA-3471",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3471"
            },
            {
              "name": "DSA-3434",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3434"
            },
            {
              "name": "SUSE-SU-2016:0911",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8550",
    "datePublished": "2016-04-14T14:00:00",
    "dateReserved": "2015-12-14T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8619 (GCVE-0-2015-8619)

Vulnerability from cvelistv5

Published

2017-04-13 17:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2015/12/23/1	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/79668	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151223 CVE request Qemu: hmp: stack based OOB write in hmp_sendkey routine",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/23/1"
          },
          {
            "name": "79668",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79668"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "[qemu-devel]  20151217 [Qemu-devel] [PATCH] hmp: avoid redundant null termination of buffer",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20151223 CVE request Qemu: hmp: stack based OOB write in hmp_sendkey routine",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/23/1"
        },
        {
          "name": "79668",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79668"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "[qemu-devel]  20151217 [Qemu-devel] [PATCH] hmp: avoid redundant null termination of buffer",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8619",
    "datePublished": "2017-04-13T17:00:00",
    "dateReserved": "2015-12-22T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8345 (GCVE-0-2015-8345)

Vulnerability from cvelistv5

Published

2017-04-13 17:00

Modified

2024-08-06 08:13

Severity ?

CWE

Summary

The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.

References

►

URL

Tags

	http://www.securityfocus.com/bid/77985	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2015/11/25/11	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:13:32.275Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "77985",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/77985"
          },
          {
            "name": "[oss-security] 20151125 Re: CVE request Qemu: net: eepro100: infinite loop in processing command block list",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/11/25/11"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "[qemu-devel] 20151016 [Qemu-devel] [PATCH] eepro100: prevent an infinite loop over same comman",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "77985",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/77985"
        },
        {
          "name": "[oss-security] 20151125 Re: CVE request Qemu: net: eepro100: infinite loop in processing command block list",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/11/25/11"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "[qemu-devel] 20151016 [Qemu-devel] [PATCH] eepro100: prevent an infinite loop over same comman",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8345",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "77985",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/77985"
            },
            {
              "name": "[oss-security] 20151125 Re: CVE request Qemu: net: eepro100: infinite loop in processing command block list",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/11/25/11"
            },
            {
              "name": "DSA-3469",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3469"
            },
            {
              "name": "DSA-3470",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3470"
            },
            {
              "name": "[qemu-devel] 20151016 [Qemu-devel] [PATCH] eepro100: prevent an infinite loop over same comman",
              "refsource": "MLIST",
              "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html"
            },
            {
              "name": "DSA-3471",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3471"
            },
            {
              "name": "GLSA-201602-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201602-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8345",
    "datePublished": "2017-04-13T17:00:00",
    "dateReserved": "2015-11-25T00:00:00",
    "dateUpdated": "2024-08-06T08:13:32.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8558 (GCVE-0-2015-8558)

Vulnerability from cvelistv5

Published

2016-05-23 19:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2015/12/14/9	mailing-list, x_refsource_MLIST
	https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02124.html	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2015/12/14/16	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/80694	vdb-entry, x_refsource_BID
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=1277983	x_refsource_CONFIRM
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=156a2e4dbffa85997636a7a39ef12da6f1b40254	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151214 CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/14/9"
          },
          {
            "name": "[qemu-devel] 20151214 [PATCH] ehci: make idt processing more robust",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02124.html"
          },
          {
            "name": "[oss-security] 20151214 Re: CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/14/16"
          },
          {
            "name": "80694",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/80694"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277983"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=156a2e4dbffa85997636a7a39ef12da6f1b40254"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20151214 CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/14/9"
        },
        {
          "name": "[qemu-devel] 20151214 [PATCH] ehci: make idt processing more robust",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02124.html"
        },
        {
          "name": "[oss-security] 20151214 Re: CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/14/16"
        },
        {
          "name": "80694",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/80694"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277983"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=156a2e4dbffa85997636a7a39ef12da6f1b40254"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-8558",
    "datePublished": "2016-05-23T19:00:00",
    "dateReserved": "2015-12-14T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4527 (GCVE-0-2013-4527)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.

References

►

URL

Tags

	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2014-0927.html	vendor-advisory, x_refsource_REDHAT
	http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3f1c49e2136fa08ab1ef3183fd55def308829584	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:14.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "RHSA-2014:0927",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0927.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3f1c49e2136fa08ab1ef3183fd55def308829584"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-05-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "RHSA-2014:0927",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0927.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3f1c49e2136fa08ab1ef3183fd55def308829584"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4527",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:14.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3640 (GCVE-0-2014-3640)

Vulnerability from cvelistv5

Published

2014-11-07 19:00

Modified

2024-08-06 10:50

Severity ?

CWE

Summary

The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

References

►

URL

Tags

	http://www.debian.org/security/2014/dsa-3045	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=1144818	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2015-0624.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2015-0349.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2014/dsa-3044	vendor-advisory, x_refsource_DEBIAN
	http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html	mailing-list, x_refsource_MLIST
	http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html	mailing-list, x_refsource_MLIST
	http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html	mailing-list, x_refsource_MLIST
	http://www.ubuntu.com/usn/USN-2409-1	vendor-advisory, x_refsource_UBUNTU

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:18.275Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3045",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3045"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1144818"
          },
          {
            "name": "RHSA-2015:0624",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0624.html"
          },
          {
            "name": "RHSA-2015:0349",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0349.html"
          },
          {
            "name": "DSA-3044",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3044"
          },
          {
            "name": "[Qemu-devel] 20140923 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html"
          },
          {
            "name": "[Qemu-devel] 20140918 [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html"
          },
          {
            "name": "[Qemu-devel] 20140924 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html"
          },
          {
            "name": "USN-2409-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2409-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-09-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-03T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-3045",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3045"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1144818"
        },
        {
          "name": "RHSA-2015:0624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0624.html"
        },
        {
          "name": "RHSA-2015:0349",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0349.html"
        },
        {
          "name": "DSA-3044",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3044"
        },
        {
          "name": "[Qemu-devel] 20140923 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html"
        },
        {
          "name": "[Qemu-devel] 20140918 [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html"
        },
        {
          "name": "[Qemu-devel] 20140924 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html"
        },
        {
          "name": "USN-2409-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2409-1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3640",
    "datePublished": "2014-11-07T19:00:00",
    "dateReserved": "2014-05-14T00:00:00",
    "dateUpdated": "2024-08-06T10:50:18.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8554 (GCVE-0-2015-8554)

Vulnerability from cvelistv5

Published

2016-04-14 14:00

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."

References

►

URL

Tags

	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1034481	vdb-entry, x_refsource_SECTRACK
	http://xenbits.xen.org/xsa/advisory-164.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/79579	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO
	http://support.citrix.com/article/CTX203879	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
          },
          {
            "name": "1034481",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034481"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-164.html"
          },
          {
            "name": "79579",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79579"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX203879"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a \"write path.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
        },
        {
          "name": "1034481",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034481"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-164.html"
        },
        {
          "name": "79579",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79579"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX203879"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8554",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a \"write path.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
            },
            {
              "name": "1034481",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034481"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-164.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-164.html"
            },
            {
              "name": "79579",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/79579"
            },
            {
              "name": "GLSA-201604-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201604-03"
            },
            {
              "name": "http://support.citrix.com/article/CTX203879",
              "refsource": "CONFIRM",
              "url": "http://support.citrix.com/article/CTX203879"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8554",
    "datePublished": "2016-04-14T14:00:00",
    "dateReserved": "2015-12-14T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7512 (GCVE-0-2015-7512)

Vulnerability from cvelistv5

Published

2016-01-08 21:00

Modified

2024-08-06 07:51

Severity ?

CWE

Summary

Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.

References

►

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2015-2694.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2015/11/30/3	mailing-list, x_refsource_MLIST
	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	x_refsource_CONFIRM
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f	x_refsource_CONFIRM
	http://www.debian.org/security/2016/dsa-3469	vendor-advisory, x_refsource_DEBIAN
	http://www.debian.org/security/2016/dsa-3470	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/78230	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1034527	vdb-entry, x_refsource_SECTRACK
	http://www.debian.org/security/2016/dsa-3471	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	http://rhn.redhat.com/errata/RHSA-2015-2696.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2015-2695.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.099Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2015:2694",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2694.html"
          },
          {
            "name": "[oss-security] 20151130 CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/11/30/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f"
          },
          {
            "name": "DSA-3469",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3469"
          },
          {
            "name": "DSA-3470",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3470"
          },
          {
            "name": "78230",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78230"
          },
          {
            "name": "1034527",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034527"
          },
          {
            "name": "DSA-3471",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3471"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "name": "RHSA-2015:2696",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2696.html"
          },
          {
            "name": "RHSA-2015:2695",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2695.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2015:2694",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2694.html"
        },
        {
          "name": "[oss-security] 20151130 CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/11/30/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03f"
        },
        {
          "name": "DSA-3469",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3469"
        },
        {
          "name": "DSA-3470",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3470"
        },
        {
          "name": "78230",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78230"
        },
        {
          "name": "1034527",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034527"
        },
        {
          "name": "DSA-3471",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3471"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "name": "RHSA-2015:2696",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2696.html"
        },
        {
          "name": "RHSA-2015:2695",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2695.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-7512",
    "datePublished": "2016-01-08T21:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:28.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4534 (GCVE-0-2013-4534)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.

References

►

URL

Tags

	http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e	x_refsource_CONFIRM
	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:14.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e"
          },
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e"
        },
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4534",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:14.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2538 (GCVE-0-2016-2538)

Vulnerability from cvelistv5

Published

2016-06-16 18:00

Modified

2024-08-05 23:32

Severity ?

CWE

Summary

Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.

References

►

URL

Tags

	http://www.securityfocus.com/bid/83336	vdb-entry, x_refsource_BID
	https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03658.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e	x_refsource_CONFIRM
	http://www.ubuntu.com/usn/USN-2974-1	vendor-advisory, x_refsource_UBUNTU
	http://www.openwall.com/lists/oss-security/2016/02/22/3	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1303120	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	mailing-list, x_refsource_MLIST
	http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:32:20.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "83336",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/83336"
          },
          {
            "name": "[qemu-devel] 20160216 [Qemu-devel] [PATCH 2/2] usb: check RNDIS buffer offsets \u0026 length",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03658.html"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e"
          },
          {
            "name": "USN-2974-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2974-1"
          },
          {
            "name": "[oss-security] 20160222 CVE request Qemu: usb: integer overflow in remote NDIS control message handling",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/02/22/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1303120"
          },
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
          },
          {
            "name": "[qemu-stable] 20160329 [Qemu-stable] [ANNOUNCE] QEMU 2.5.1 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-01T10:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "83336",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/83336"
        },
        {
          "name": "[qemu-devel] 20160216 [Qemu-devel] [PATCH 2/2] usb: check RNDIS buffer offsets \u0026 length",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03658.html"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e"
        },
        {
          "name": "USN-2974-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2974-1"
        },
        {
          "name": "[oss-security] 20160222 CVE request Qemu: usb: integer overflow in remote NDIS control message handling",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/02/22/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1303120"
        },
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
        },
        {
          "name": "[qemu-stable] 20160329 [Qemu-stable] [ANNOUNCE] QEMU 2.5.1 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2538",
    "datePublished": "2016-06-16T18:00:00",
    "dateReserved": "2016-02-23T00:00:00",
    "dateUpdated": "2024-08-05T23:32:20.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2198 (GCVE-0-2016-2198)

Vulnerability from cvelistv5

Published

2016-12-29 22:00

Modified

2024-08-05 23:24

Severity ?

CWE

Summary

QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.

References

►

URL

Tags

	http://www.openwall.com/lists/oss-security/2016/01/30/2	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1301643	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/01/29/6	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201604-01	vendor-advisory, x_refsource_GENTOO
	https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:24:48.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20160130 Re: CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/30/2"
          },
          {
            "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1301643"
          },
          {
            "name": "[oss-security] 20160129 CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/01/29/6"
          },
          {
            "name": "GLSA-201604-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-01"
          },
          {
            "name": "[qemu-devel] 20160129 [PATCH] usb: ehci: add capability mmio write function",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-01-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20160130 Re: CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/30/2"
        },
        {
          "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1301643"
        },
        {
          "name": "[oss-security] 20160129 CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/01/29/6"
        },
        {
          "name": "GLSA-201604-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-01"
        },
        {
          "name": "[qemu-devel] 20160129 [PATCH] usb: ehci: add capability mmio write function",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2198",
    "datePublished": "2016-12-29T22:00:00",
    "dateReserved": "2016-01-29T00:00:00",
    "dateUpdated": "2024-08-05T23:24:48.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-4539 (GCVE-0-2013-4539)

Vulnerability from cvelistv5

Published

2014-11-04 21:00

Modified

2024-08-06 16:45

Severity ?

CWE

Summary

Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.

References

►

URL

Tags

	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5193be3be35f29a35bc465036cd64ad60d43385f	x_refsource_CONFIRM
	http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html	mailing-list, x_refsource_MLIST
	http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:45:14.836Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5193be3be35f29a35bc465036cd64ad60d43385f"
          },
          {
            "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
          },
          {
            "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
          },
          {
            "name": "FEDORA-2014-6288",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-04T20:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5193be3be35f29a35bc465036cd64ad60d43385f"
        },
        {
          "name": "[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html"
        },
        {
          "name": "[Qemu-devel] 20131213 [PATCH 00/23] qemu state loading issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html"
        },
        {
          "name": "FEDORA-2014-6288",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4539",
    "datePublished": "2014-11-04T21:00:00",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:45:14.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-6855 (GCVE-0-2015-6855)

Vulnerability from cvelistv5

Published

2015-11-06 21:00

Modified

2024-08-06 07:36

Severity ?

CWE

Summary

hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.

References

►

URL

Tags

	http://www.debian.org/security/2015/dsa-3361	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/76691	vdb-entry, x_refsource_BID
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2015/09/10/2	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html	vendor-advisory, x_refsource_SUSE
	http://www.openwall.com/lists/oss-security/2015/09/10/1	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2015/dsa-3362	vendor-advisory, x_refsource_DEBIAN
	http://www.ubuntu.com/usn/USN-2745-1	vendor-advisory, x_refsource_UBUNTU
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.html	vendor-advisory, x_refsource_FEDORA
	https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.html	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.html	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/201602-01	vendor-advisory, x_refsource_GENTOO
	https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:36:34.777Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3361",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3361"
          },
          {
            "name": "76691",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/76691"
          },
          {
            "name": "FEDORA-2015-16369",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
          },
          {
            "name": "FEDORA-2015-16370",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
          },
          {
            "name": "FEDORA-2015-d6ea74993a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.html"
          },
          {
            "name": "[oss-security] 20150910 Re: CVE request Qemu: ide: divide by zero issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/09/10/2"
          },
          {
            "name": "SUSE-SU-2015:1782",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
          },
          {
            "name": "[oss-security] 20150910 CVE request Qemu: ide: divide by zero issue",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/09/10/1"
          },
          {
            "name": "FEDORA-2015-16368",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
          },
          {
            "name": "DSA-3362",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3362"
          },
          {
            "name": "USN-2745-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2745-1"
          },
          {
            "name": "FEDORA-2015-8dc71ade88",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.html"
          },
          {
            "name": "[Qemu-devel] 20150907 [PATCH] ide: fix ATAPI command permissions",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.html"
          },
          {
            "name": "FEDORA-2015-4896530727",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.html"
          },
          {
            "name": "GLSA-201602-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-01"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-09-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-05T17:00:18",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-3361",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3361"
        },
        {
          "name": "76691",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/76691"
        },
        {
          "name": "FEDORA-2015-16369",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html"
        },
        {
          "name": "FEDORA-2015-16370",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html"
        },
        {
          "name": "FEDORA-2015-d6ea74993a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.html"
        },
        {
          "name": "[oss-security] 20150910 Re: CVE request Qemu: ide: divide by zero issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/09/10/2"
        },
        {
          "name": "SUSE-SU-2015:1782",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html"
        },
        {
          "name": "[oss-security] 20150910 CVE request Qemu: ide: divide by zero issue",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/09/10/1"
        },
        {
          "name": "FEDORA-2015-16368",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html"
        },
        {
          "name": "DSA-3362",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3362"
        },
        {
          "name": "USN-2745-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2745-1"
        },
        {
          "name": "FEDORA-2015-8dc71ade88",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.html"
        },
        {
          "name": "[Qemu-devel] 20150907 [PATCH] ide: fix ATAPI command permissions",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.html"
        },
        {
          "name": "FEDORA-2015-4896530727",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.html"
        },
        {
          "name": "GLSA-201602-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-01"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-6855",
    "datePublished": "2015-11-06T21:00:00",
    "dateReserved": "2015-09-10T00:00:00",
    "dateUpdated": "2024-08-06T07:36:34.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2016:1318-1

Vulnerability from csaf_suse

CVE-2015-8568 (GCVE-0-2015-8568)

Vulnerability from cvelistv5

CVE-2016-1571 (GCVE-0-2016-1571)

Vulnerability from cvelistv5

CVE-2013-4538 (GCVE-0-2013-4538)

Vulnerability from cvelistv5

CVE-2015-8567 (GCVE-0-2015-8567)

Vulnerability from cvelistv5

CVE-2015-8504 (GCVE-0-2015-8504)

Vulnerability from cvelistv5

CVE-2015-7549 (GCVE-0-2015-7549)

Vulnerability from cvelistv5

CVE-2015-1779 (GCVE-0-2015-1779)

Vulnerability from cvelistv5

CVE-2016-1568 (GCVE-0-2016-1568)

Vulnerability from cvelistv5

CVE-2015-8744 (GCVE-0-2015-8744)

Vulnerability from cvelistv5

CVE-2013-4529 (GCVE-0-2013-4529)

Vulnerability from cvelistv5

CVE-2015-8817 (GCVE-0-2015-8817)

Vulnerability from cvelistv5

CVE-2014-7815 (GCVE-0-2014-7815)

Vulnerability from cvelistv5

CVE-2015-8745 (GCVE-0-2015-8745)

Vulnerability from cvelistv5

CVE-2015-5278 (GCVE-0-2015-5278)

Vulnerability from cvelistv5

CVE-2016-1714 (GCVE-0-2016-1714)

Vulnerability from cvelistv5

CVE-2014-0222 (GCVE-0-2014-0222)

Vulnerability from cvelistv5

CVE-2016-1922 (GCVE-0-2016-1922)

Vulnerability from cvelistv5

CVE-2014-3689 (GCVE-0-2014-3689)

Vulnerability from cvelistv5

CVE-2015-8555 (GCVE-0-2015-8555)

Vulnerability from cvelistv5

CVE-2015-8743 (GCVE-0-2015-8743)

Vulnerability from cvelistv5

CVE-2016-2271 (GCVE-0-2016-2271)

Vulnerability from cvelistv5

CVE-2016-2270 (GCVE-0-2016-2270)

Vulnerability from cvelistv5

CVE-2014-9718 (GCVE-0-2014-9718)

Vulnerability from cvelistv5

CVE-2016-1981 (GCVE-0-2016-1981)

Vulnerability from cvelistv5

CVE-2013-4530 (GCVE-0-2013-4530)

Vulnerability from cvelistv5

CVE-2015-8613 (GCVE-0-2015-8613)

Vulnerability from cvelistv5

CVE-2016-1570 (GCVE-0-2016-1570)

Vulnerability from cvelistv5

CVE-2016-2391 (GCVE-0-2016-2391)

Vulnerability from cvelistv5

CVE-2016-2392 (GCVE-0-2016-2392)

Vulnerability from cvelistv5

CVE-2015-8818 (GCVE-0-2015-8818)

Vulnerability from cvelistv5

CVE-2013-4537 (GCVE-0-2013-4537)

Vulnerability from cvelistv5

CVE-2013-4533 (GCVE-0-2013-4533)

Vulnerability from cvelistv5

CVE-2015-8550 (GCVE-0-2015-8550)

Vulnerability from cvelistv5

CVE-2015-8619 (GCVE-0-2015-8619)

Vulnerability from cvelistv5

CVE-2015-8345 (GCVE-0-2015-8345)

Vulnerability from cvelistv5

CVE-2015-8558 (GCVE-0-2015-8558)

Vulnerability from cvelistv5

CVE-2013-4527 (GCVE-0-2013-4527)

Vulnerability from cvelistv5

CVE-2014-3640 (GCVE-0-2014-3640)

Vulnerability from cvelistv5

CVE-2015-8554 (GCVE-0-2015-8554)