The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5133 advisory.

    Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial     of service or the execution of arbitrary code. For the stable distribution (bullseye), this problem has     been fixed in version 1:5.2+dfsg-11+deb11u2. We recommend that you upgrade your qemu packages. For the     detailed security status of qemu please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/qemu

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2061 advisory.

    A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

    A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI     I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req'     from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the     host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
    (CVE-2021-3392)

    A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a     single, large transfer request, to reduce the overhead and improve performance. The combined size of the     bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a     denial of service. (CVE-2021-3527)

    An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
    (CVE-2021-3930)

    A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-27 (QEMU: Multiple Vulnerabilities)

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This     occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or     process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or     potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
    (CVE-2020-15863)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

  - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2020-35504)

  - A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw     allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-35505)

  - A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows     a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or     potential code execution with the privileges of the QEMU process. (CVE-2020-35506)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It     may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A     privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
    (CVE-2021-20203)

  - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability. (CVE-2021-20257)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

  - The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to     the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This     flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of     service or potential code execution. QEMU up to (including) 5.2.0 is affected by this. (CVE-2021-3409)

  - A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions     up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get     bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the     host resulting in DoS scenario. (CVE-2021-3416)

  - A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a     single, large transfer request, to reduce the overhead and improve performance. The combined size of the     bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a     denial of service. (CVE-2021-3527)

  - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions     up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-     gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. (CVE-2021-3544)

  - An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-     user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit     this issue to leak memory from the host. (CVE-2021-3545)

  - An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET'     command from the guest. It could allow a privileged guest user to crash the QEMU process on the host,     resulting in a denial of service condition, or potential code execution with the privileges of the QEMU     process. (CVE-2021-3546)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while     handling a PVRDMA_CMD_CREATE_MR command due to improper memory remapping (mremap). This flaw allows a     malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to     system availability. (CVE-2021-3582)

  - An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions     prior to 6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest due to     improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount     of memory, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2021-3607)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to     6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest and may result in a     crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest     threat from this vulnerability is to system availability. (CVE-2021-3608)

  - A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious     guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU     versions prior to 7.0.0. (CVE-2021-3611)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions     prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-     bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this     flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the     host. (CVE-2021-3713)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
    (CVE-2021-3930)

  - A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist()     where a malicious guest controlling certain input can read out of bounds memory. A malicious user could     use this flaw leading to disclosure of sensitive information. (CVE-2021-3947)

  - A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0.
    The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A     malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host     when writing data reaches the threshold of mirroring node. (CVE-2021-4145)

  - A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4206)

  - A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

  - A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for     CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and     other unexpected results. Affected QEMU version: 6.2.0. (CVE-2022-26353)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-3929)

  - QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

  - QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 (CVE-2022-0358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9669 advisory.

    - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella)  [Orabug:
    34049511]  {CVE-2021-4207}
    - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella)  [Orabug:
    34049509]  {CVE-2021-4206}
    - hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507) (Philippe Mathieu-Daude)  [Orabug: 32860387]     {CVE-2021-3507}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8412-1 advisory.

    Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU     incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

    It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations,     leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive     information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

    Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local     attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

    Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an     infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2020-14394)

    Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-15469)

    Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-     free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

    Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

    Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in     a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-17380)

    Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that the USB xHCI controller     implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

    Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU     contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-25624)

    It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An     attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

    Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures,     leading to a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU     to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25723)

    Gaoning Pan discovered that the network device emulation in QEMU could be made to trigger an assertion     failure when processing packets that lacked a valid layer 3 protocol. An attacker inside the guest could     possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-27617)

    Wenxiang Qian discovered that the ATAPI emulation in QEMU did not properly validate a buffer index,     leading to an out-of-bounds read. An attacker inside the guest could possibly use this issue to expose     sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-29443)

    Cheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)

    Cheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation in QEMU contained a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-35505)

    It was discovered that the SDHCI controller emulation in QEMU contained out-of-bounds read and write     issues. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3409)

    It was discovered that several network device emulations in QEMU contained an infinite loop when operating     in loopback mode. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2021-3416)

    Alexander Bulekov discovered that the floppy disk emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to expose sensitive information or     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3507)

    Remy Noel discovered that the USB redirector device emulation in QEMU performed an unbounded stack     allocation when combining USB packets. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu     16.04 LTS. (CVE-2021-3527)

    It was discovered that the QXL display device emulation in QEMU contained an integer overflow, leading to     a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)

    It was discovered that the QXL display device emulation in QEMU performed a double fetch of guest-     controlled values, leading to a heap-based buffer overflow. An attacker inside the guest could possibly     use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4207)

    It was discovered that the 9pfs server implementation in QEMU contained a race condition, leading to a     use-after-free. A malicious 9p client could possibly use this issue to escalate privileges. This issue     only affected Ubuntu 14.04 LTS. (CVE-2021-20181)

    Gaoning Pan discovered that the floppy disk emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)

    Gaoning Pan discovered that the vmxnet3 network device emulation in QEMU contained an integer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20203)

    It was discovered that the ARM Generic Interrupt Controller emulation in QEMU contained an out-of-bounds     heap access. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20221)

    Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered     that the e1000 network device emulation in QEMU contained an infinite loop. An attacker inside the guest     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20257)

    It was discovered that the 9p passthrough file system implementation in QEMU did not prevent opening     special files on the host. A malicious guest could possibly use this issue to escape the exported 9p tree.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-2861)

    It was discovered that the virtio crypto device emulation in QEMU did not properly validate certain buffer     lengths, leading to a heap buffer overflow. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 18.04 LTS. (CVE-2023-3180)

    It was discovered that the built-in VNC server in QEMU contained a NULL pointer dereference when cleaning     up a connection that failed during the handshake. A remote attacker could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2023-3354)

    It was discovered that QEMU could incorrectly direct a guest I/O operation to disk offset 0 instead of the     intended offset. An attacker inside the guest could possibly use this issue to read or overwrite sensitive     data, potentially gaining control of the host. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04     LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)

    It was discovered that several virtio device emulations in QEMU did not properly guard against DMA     reentrancy, leading to a double free. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-3446)

    It was discovered that the SDHCI device emulation in QEMU contained a heap- based buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-3447)

    It was discovered that the QEMU disk image utility (qemu-img) did not properly handle certain crafted     image files. An attacker could possibly use this issue to cause qemu-img to consume excessive resources or     access an unintended external file, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS. (CVE-2024-4467)

    Cyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter emulation in QEMU contained a use-     after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519)

    It was discovered that the NBD server in QEMU contained an improper synchronization issue during socket     closure. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-7409)

    It was discovered that the USB emulation in QEMU contained a reachable assertion. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2024-8354)

    It was discovered that QEMU incorrectly handled resources during the VNC WebSocket handshake, leading to a     use-after-free. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-11234)

    It was discovered that QEMU could be made to read out of bounds when reading VMDK images. An attacker     could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a     denial of service. (CVE-2026-2243)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160887	Debian DSA-5133-1 : qemu - security update	Nessus	Debian Local Security Checks	2022/5/10	2025/1/24	high
176677	Amazon Linux 2 : qemu (ALAS-2023-2061)	Nessus	Amazon Linux Local Security Checks	2023/6/5	2024/12/11	high
164115	GLSA-202208-27 : QEMU: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/15	2023/10/16	high
163677	Oracle Linux 7 : qemu (ELSA-2022-9669)	Nessus	Oracle Linux Local Security Checks	2022/8/1	2024/11/2	high
320399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-8412-1)	Nessus	Ubuntu Local Security Checks	2026/6/11	2026/6/11	high
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/4/30	medium

检测

插件搜索

high

high

high

high

high

medium