https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:13:19 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-05693 bdu:2022-05693 https://cve.radiocsirt.org/vuln/bdu:2022-05693 https://cve.radiocsirt.org/vuln/bell-cve-2021-3682 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-3682 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0318 certfr-2023-avi-0318 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0318 https://cve.radiocsirt.org/vuln/euvd-2026-20966 EUVD-2026-20966 https://cve.radiocsirt.org/vuln/euvd-2026-20966 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3682 <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3682 https://cve.radiocsirt.org/vuln/ghsa-2w4j-r5v6-3vgr <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> https://cve.radiocsirt.org/vuln/ghsa-2w4j-r5v6-3vgr https://cve.radiocsirt.org/vuln/gsd-2021-3682 gsd-2021-3682 https://cve.radiocsirt.org/vuln/gsd-2021-3682 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3682 msrc_CVE-2021-3682 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3682 https://cve.radiocsirt.org/vuln/oesa-2021-1316 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: qemu, openEuler:20.03-LTS-SP2: qemu</p> <p>QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.(CVE-2021-3682)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: qemu, openEuler:20.03-LTS-SP2: qemu</p> <p>QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.(CVE-2021-3682)</p> https://cve.radiocsirt.org/vuln/oesa-2021-1316 https://cve.radiocsirt.org/vuln/opensuse-su-2021:2789-1 <p>Security update for qemu</p> <p>Security update for qemu</p> https://cve.radiocsirt.org/vuln/opensuse-su-2021:2789-1 https://cve.radiocsirt.org/vuln/rhsa-2021:3703 <p>QEMU: net: Infinite loop in loopback mode may lead to stack overflow libvirt: Insecure sVirt label generation libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API QEMU: usbredir: free() call on invalid pointer in bufp_alloc() ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() ntfs-3g: Endless recursion from ntfs_attr_pw…</p> <p>QEMU: net: Infinite loop in loopback mode may lead to stack overflow libvirt: Insecure sVirt label generation libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API QEMU: usbredir: free() call on invalid pointer in bufp_alloc() ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() ntfs-3g: Endless recursion from ntfs_attr_pw…</p> https://cve.radiocsirt.org/vuln/rhsa-2021:3703 https://cve.radiocsirt.org/vuln/suse-su-2021:14848-1 <p>Security update for xen</p> <p>Security update for xen</p> https://cve.radiocsirt.org/vuln/suse-su-2021:14848-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3682 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:18.04:LTS: qemu, Ubuntu:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu</p> <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:18.04:LTS: qemu, Ubuntu:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu</p> <p>A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3682 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1118 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in QEMU ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und einen Denial of Service Zustand herzustellen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in QEMU ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und einen Denial of Service Zustand herzustellen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1118