rpm package
almalinux/qemu-kvm-audio-pa
pkg:rpm/almalinux/qemu-kvm-audio-pa
Vulnerabilities (26)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-11234 | Hig | 7.5 | < 18:10.0.0-14.el10_1.5.alma.1 | 18:10.0.0-14.el10_1.5.alma.1 | Oct 3, 2025 | A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client w | |
| CVE-2024-11699 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < | ||
| CVE-2024-11697 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thu | ||
| CVE-2024-11696 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation proces | ||
| CVE-2024-11695 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. | ||
| CVE-2024-11694 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. T | ||
| CVE-2024-11692 | — | < 18:10.1.0-16.el10_2.alma.1 | 18:10.1.0-16.el10_2.alma.1 | Nov 26, 2024 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. | ||
| CVE-2024-7409 | Hig | 7.5 | < 17:9.0.0-10.el9_5 | 17:9.0.0-10.el9_5 | Aug 5, 2024 | A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. | |
| CVE-2024-4467 | Hig | 7.8 | < 17:8.2.0-11.el9_4.4 | 17:8.2.0-11.el9_4.4 | Jul 2, 2024 | A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of | |
| CVE-2024-3446 | Hig | 8.2 | < 17:9.0.0-10.el9_5 | 17:9.0.0-10.el9_5 | Apr 9, 2024 | A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU proce | |
| CVE-2024-26327 | — | < 17:9.0.0-10.el9_5 | 17:9.0.0-10.el9_5 | Feb 19, 2024 | An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations. | ||
| CVE-2023-6683 | — | < 17:8.2.0-11.el9_4 | 17:8.2.0-11.el9_4 | Jan 12, 2024 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. | ||
| CVE-2023-5088 | — | < 17:8.2.0-11.el9_4 | 17:8.2.0-11.el9_4 | Nov 3, 2023 | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of | ||
| CVE-2023-2680 | — | < 17:8.0.0-16.el9_3.alma.1 | 17:8.0.0-16.el9_3.alma.1 | Sep 13, 2023 | This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750. | ||
| CVE-2023-3255 | — | < 17:8.2.0-11.el9_4 | 17:8.2.0-11.el9_4 | Sep 13, 2023 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is | ||
| CVE-2023-42467 | — | < 17:8.2.0-11.el9_4 | 17:8.2.0-11.el9_4 | Sep 11, 2023 | QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately. | ||
| CVE-2023-3019 | Med | 6.0 | < 17:8.2.0-11.el9_4 | 17:8.2.0-11.el9_4 | Jul 24, 2023 | A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. | |
| CVE-2023-3354 | — | < 17:7.2.0-14.el9_2.5.alma.1 | 17:7.2.0-14.el9_2.5.alma.1 | Jul 11, 2023 | A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake ph | ||
| CVE-2022-4172 | — | < 17:7.2.0-14.el9_2 | 17:7.2.0-14.el9_2 | Nov 29, 2022 | An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory devic | ||
| CVE-2022-3165 | — | < 17:7.2.0-14.el9_2 | 17:7.2.0-14.el9_2 | Oct 17, 2022 | An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service. |
- affected < 18:10.0.0-14.el10_1.5.alma.1fixed 18:10.0.0-14.el10_1.5.alma.1
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client w
- CVE-2024-11699Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox <
- CVE-2024-11697Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thu
- CVE-2024-11696Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation proces
- CVE-2024-11695Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
- CVE-2024-11694Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. T
- CVE-2024-11692Nov 26, 2024affected < 18:10.1.0-16.el10_2.alma.1fixed 18:10.1.0-16.el10_2.alma.1
An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
- affected < 17:9.0.0-10.el9_5fixed 17:9.0.0-10.el9_5
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
- affected < 17:8.2.0-11.el9_4.4fixed 17:8.2.0-11.el9_4.4
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of
- affected < 17:9.0.0-10.el9_5fixed 17:9.0.0-10.el9_5
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU proce
- CVE-2024-26327Feb 19, 2024affected < 17:9.0.0-10.el9_5fixed 17:9.0.0-10.el9_5
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.
- CVE-2023-6683Jan 12, 2024affected < 17:8.2.0-11.el9_4fixed 17:8.2.0-11.el9_4
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference.
- CVE-2023-5088Nov 3, 2023affected < 17:8.2.0-11.el9_4fixed 17:8.2.0-11.el9_4
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of
- CVE-2023-2680Sep 13, 2023affected < 17:8.0.0-16.el9_3.alma.1fixed 17:8.0.0-16.el9_3.alma.1
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
- CVE-2023-3255Sep 13, 2023affected < 17:8.2.0-11.el9_4fixed 17:8.2.0-11.el9_4
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is
- CVE-2023-42467Sep 11, 2023affected < 17:8.2.0-11.el9_4fixed 17:8.2.0-11.el9_4
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
- affected < 17:8.2.0-11.el9_4fixed 17:8.2.0-11.el9_4
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
- CVE-2023-3354Jul 11, 2023affected < 17:7.2.0-14.el9_2.5.alma.1fixed 17:7.2.0-14.el9_2.5.alma.1
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake ph
- CVE-2022-4172Nov 29, 2022affected < 17:7.2.0-14.el9_2fixed 17:7.2.0-14.el9_2
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory devic
- CVE-2022-3165Oct 17, 2022affected < 17:7.2.0-14.el9_2fixed 17:7.2.0-14.el9_2
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
Page 1 of 2