Multiple vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2017-14167

Incorrect validation of multiboot headers could result in the execution of arbitrary code.

CVE-2017-15038

When using 9pfs qemu-kvm is vulnerable to an information disclosure issue. It could occur while accessing extended attributes of a file due to a race condition. This could be used to disclose heap memory contents of the host.

For Debian 7 'Wheezy', these problems have been fixed in version 1.1.2+dfsg-6+deb7u24.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4285 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103714	Debian DLA-1129-1 : qemu security update	Nessus	Debian Local Security Checks	2017/10/9	2025/11/19	high
180778	Oracle Linux 7 : qemu (ELSA-2018-4285)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical

检测

插件搜索

high

critical

critical