Vulnerability-Lookup

ubuntu-cve-2021-20196

Vulnerability from osv_ubuntu

Published

2021-05-26 22:15

Modified

2026-06-09 19:04

Summary

Details

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2021-20196	REPORT
	https://lists.nongnu.org/archive/html/qemu-devel/…	REPORT
	https://www.openwall.com/lists/oss-security/2021/…	REPORT
	https://ubuntu.com/security/notices/USN-5307-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-20196	REPORT
	https://ubuntu.com/security/notices/USN-8412-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-keymaps",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@2.0.0+dfsg-2ubuntu1.47+esm6?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0+dfsg-2ubuntu1.47+esm6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.0+dfsg-3ubuntu5",
        "1.5.0+dfsg-3ubuntu6",
        "1.6.0+dfsg-2ubuntu1",
        "1.6.0+dfsg-2ubuntu2",
        "1.6.0+dfsg-2ubuntu3",
        "1.6.0+dfsg-2ubuntu4",
        "1.7.0+dfsg-2ubuntu1",
        "1.7.0+dfsg-2ubuntu2",
        "1.7.0+dfsg-2ubuntu3",
        "1.7.0+dfsg-2ubuntu4",
        "1.7.0+dfsg-2ubuntu5",
        "1.7.0+dfsg-2ubuntu7",
        "1.7.0+dfsg-2ubuntu8",
        "1.7.0+dfsg-2ubuntu9",
        "1.7.0+dfsg-3ubuntu1~ppa1",
        "1.7.0+dfsg-3ubuntu1",
        "1.7.0+dfsg-3ubuntu2",
        "1.7.0+dfsg-3ubuntu3",
        "1.7.0+dfsg-3ubuntu4",
        "1.7.0+dfsg-3ubuntu5",
        "1.7.0+dfsg-3ubuntu6",
        "1.7.0+dfsg-3ubuntu7",
        "2.0.0~rc1+dfsg-0ubuntu1",
        "2.0.0~rc1+dfsg-0ubuntu2",
        "2.0.0~rc1+dfsg-0ubuntu3",
        "2.0.0~rc1+dfsg-0ubuntu3.1",
        "2.0.0+dfsg-2ubuntu1",
        "2.0.0+dfsg-2ubuntu1.1",
        "2.0.0+dfsg-2ubuntu1.2",
        "2.0.0+dfsg-2ubuntu1.3",
        "2.0.0+dfsg-2ubuntu1.5",
        "2.0.0+dfsg-2ubuntu1.6",
        "2.0.0+dfsg-2ubuntu1.7",
        "2.0.0+dfsg-2ubuntu1.8",
        "2.0.0+dfsg-2ubuntu1.9",
        "2.0.0+dfsg-2ubuntu1.10",
        "2.0.0+dfsg-2ubuntu1.11",
        "2.0.0+dfsg-2ubuntu1.13",
        "2.0.0+dfsg-2ubuntu1.14",
        "2.0.0+dfsg-2ubuntu1.15",
        "2.0.0+dfsg-2ubuntu1.16",
        "2.0.0+dfsg-2ubuntu1.17",
        "2.0.0+dfsg-2ubuntu1.18",
        "2.0.0+dfsg-2ubuntu1.19",
        "2.0.0+dfsg-2ubuntu1.20",
        "2.0.0+dfsg-2ubuntu1.21",
        "2.0.0+dfsg-2ubuntu1.22",
        "2.0.0+dfsg-2ubuntu1.24",
        "2.0.0+dfsg-2ubuntu1.25",
        "2.0.0+dfsg-2ubuntu1.26",
        "2.0.0+dfsg-2ubuntu1.27",
        "2.0.0+dfsg-2ubuntu1.28",
        "2.0.0+dfsg-2ubuntu1.29",
        "2.0.0+dfsg-2ubuntu1.30",
        "2.0.0+dfsg-2ubuntu1.31",
        "2.0.0+dfsg-2ubuntu1.32",
        "2.0.0+dfsg-2ubuntu1.33",
        "2.0.0+dfsg-2ubuntu1.34",
        "2.0.0+dfsg-2ubuntu1.35",
        "2.0.0+dfsg-2ubuntu1.36",
        "2.0.0+dfsg-2ubuntu1.38",
        "2.0.0+dfsg-2ubuntu1.39",
        "2.0.0+dfsg-2ubuntu1.40",
        "2.0.0+dfsg-2ubuntu1.41",
        "2.0.0+dfsg-2ubuntu1.42",
        "2.0.0+dfsg-2ubuntu1.43",
        "2.0.0+dfsg-2ubuntu1.44",
        "2.0.0+dfsg-2ubuntu1.45",
        "2.0.0+dfsg-2ubuntu1.46",
        "2.0.0+dfsg-2ubuntu1.47",
        "2.0.0+dfsg-2ubuntu1.47+esm1",
        "2.0.0+dfsg-2ubuntu1.47+esm2",
        "2.0.0+dfsg-2ubuntu1.47+esm3",
        "2.0.0+dfsg-2ubuntu1.47+esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:2.5+dfsg-5ubuntu10.51+esm4?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.5+dfsg-5ubuntu10.51+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3+dfsg-5ubuntu9",
        "1:2.3+dfsg-5ubuntu10",
        "1:2.4+dfsg-4ubuntu1",
        "1:2.4+dfsg-4ubuntu2",
        "1:2.4+dfsg-4ubuntu3",
        "1:2.4+dfsg-5ubuntu3",
        "1:2.5+dfsg-1ubuntu2",
        "1:2.5+dfsg-1ubuntu3",
        "1:2.5+dfsg-1ubuntu4",
        "1:2.5+dfsg-1ubuntu5",
        "1:2.5+dfsg-5ubuntu1",
        "1:2.5+dfsg-5ubuntu2",
        "1:2.5+dfsg-5ubuntu4",
        "1:2.5+dfsg-5ubuntu6",
        "1:2.5+dfsg-5ubuntu7",
        "1:2.5+dfsg-5ubuntu10",
        "1:2.5+dfsg-5ubuntu10.1",
        "1:2.5+dfsg-5ubuntu10.2",
        "1:2.5+dfsg-5ubuntu10.3",
        "1:2.5+dfsg-5ubuntu10.4",
        "1:2.5+dfsg-5ubuntu10.5",
        "1:2.5+dfsg-5ubuntu10.6",
        "1:2.5+dfsg-5ubuntu10.7",
        "1:2.5+dfsg-5ubuntu10.8",
        "1:2.5+dfsg-5ubuntu10.9",
        "1:2.5+dfsg-5ubuntu10.10",
        "1:2.5+dfsg-5ubuntu10.11",
        "1:2.5+dfsg-5ubuntu10.13",
        "1:2.5+dfsg-5ubuntu10.14",
        "1:2.5+dfsg-5ubuntu10.15",
        "1:2.5+dfsg-5ubuntu10.16",
        "1:2.5+dfsg-5ubuntu10.20",
        "1:2.5+dfsg-5ubuntu10.21",
        "1:2.5+dfsg-5ubuntu10.22",
        "1:2.5+dfsg-5ubuntu10.24",
        "1:2.5+dfsg-5ubuntu10.25",
        "1:2.5+dfsg-5ubuntu10.26",
        "1:2.5+dfsg-5ubuntu10.28",
        "1:2.5+dfsg-5ubuntu10.29",
        "1:2.5+dfsg-5ubuntu10.30",
        "1:2.5+dfsg-5ubuntu10.31",
        "1:2.5+dfsg-5ubuntu10.32",
        "1:2.5+dfsg-5ubuntu10.33",
        "1:2.5+dfsg-5ubuntu10.34",
        "1:2.5+dfsg-5ubuntu10.35",
        "1:2.5+dfsg-5ubuntu10.36",
        "1:2.5+dfsg-5ubuntu10.37",
        "1:2.5+dfsg-5ubuntu10.38",
        "1:2.5+dfsg-5ubuntu10.39",
        "1:2.5+dfsg-5ubuntu10.40",
        "1:2.5+dfsg-5ubuntu10.41",
        "1:2.5+dfsg-5ubuntu10.42",
        "1:2.5+dfsg-5ubuntu10.43",
        "1:2.5+dfsg-5ubuntu10.44",
        "1:2.5+dfsg-5ubuntu10.45",
        "1:2.5+dfsg-5ubuntu10.46",
        "1:2.5+dfsg-5ubuntu10.47",
        "1:2.5+dfsg-5ubuntu10.48",
        "1:2.5+dfsg-5ubuntu10.49",
        "1:2.5+dfsg-5ubuntu10.51",
        "1:2.5+dfsg-5ubuntu10.51+esm1",
        "1:2.5+dfsg-5ubuntu10.51+esm2",
        "1:2.5+dfsg-5ubuntu10.51+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxen-4.6",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "libxenstore3.0",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.4-amd64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.4-arm64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.4-armhf",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.5-amd64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.5-arm64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.5-armhf",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.6-amd64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.6-arm64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-hypervisor-4.6-armhf",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-system-armhf",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-utils-4.6",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.6.5-0ubuntu1.4"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.6.5-0ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.6.5-0ubuntu1.4?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.5.1-0ubuntu1",
        "4.5.1-0ubuntu2",
        "4.6.0-1ubuntu1",
        "4.6.0-1ubuntu2",
        "4.6.0-1ubuntu4",
        "4.6.0-1ubuntu4.1",
        "4.6.0-1ubuntu4.2",
        "4.6.0-1ubuntu4.3",
        "4.6.5-0ubuntu1",
        "4.6.5-0ubuntu1.1",
        "4.6.5-0ubuntu1.2",
        "4.6.5-0ubuntu1.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:2.11+dfsg-1ubuntu7.39?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.11+dfsg-1ubuntu7.39"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.10+dfsg-0ubuntu3",
        "1:2.10+dfsg-0ubuntu4",
        "1:2.10+dfsg-0ubuntu5",
        "1:2.11+dfsg-1ubuntu1",
        "1:2.11+dfsg-1ubuntu2",
        "1:2.11+dfsg-1ubuntu4",
        "1:2.11+dfsg-1ubuntu5",
        "1:2.11+dfsg-1ubuntu6",
        "1:2.11+dfsg-1ubuntu7",
        "1:2.11+dfsg-1ubuntu7.1",
        "1:2.11+dfsg-1ubuntu7.2",
        "1:2.11+dfsg-1ubuntu7.3",
        "1:2.11+dfsg-1ubuntu7.4",
        "1:2.11+dfsg-1ubuntu7.5",
        "1:2.11+dfsg-1ubuntu7.6",
        "1:2.11+dfsg-1ubuntu7.7",
        "1:2.11+dfsg-1ubuntu7.8",
        "1:2.11+dfsg-1ubuntu7.9",
        "1:2.11+dfsg-1ubuntu7.10",
        "1:2.11+dfsg-1ubuntu7.12",
        "1:2.11+dfsg-1ubuntu7.13",
        "1:2.11+dfsg-1ubuntu7.14",
        "1:2.11+dfsg-1ubuntu7.15",
        "1:2.11+dfsg-1ubuntu7.17",
        "1:2.11+dfsg-1ubuntu7.18",
        "1:2.11+dfsg-1ubuntu7.19",
        "1:2.11+dfsg-1ubuntu7.20",
        "1:2.11+dfsg-1ubuntu7.21",
        "1:2.11+dfsg-1ubuntu7.22",
        "1:2.11+dfsg-1ubuntu7.23",
        "1:2.11+dfsg-1ubuntu7.25",
        "1:2.11+dfsg-1ubuntu7.26",
        "1:2.11+dfsg-1ubuntu7.27",
        "1:2.11+dfsg-1ubuntu7.28",
        "1:2.11+dfsg-1ubuntu7.29",
        "1:2.11+dfsg-1ubuntu7.31",
        "1:2.11+dfsg-1ubuntu7.32",
        "1:2.11+dfsg-1ubuntu7.33",
        "1:2.11+dfsg-1ubuntu7.34",
        "1:2.11+dfsg-1ubuntu7.35",
        "1:2.11+dfsg-1ubuntu7.36",
        "1:2.11+dfsg-1ubuntu7.37",
        "1:2.11+dfsg-1ubuntu7.38"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxen-4.9",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "libxenstore3.0",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.6-amd64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.6-arm64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.6-armhf",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.7-amd64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.7-arm64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.7-armhf",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.8-amd64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.8-arm64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.8-armhf",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.9-amd64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.9-arm64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-hypervisor-4.9-armhf",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-system-armhf",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-utils-4.9",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.9.2-0ubuntu1"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.9.2-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.9.2-0ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.9.0-0ubuntu3",
        "4.9.0-0ubuntu4",
        "4.9.2-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:4.2-3ubuntu6.21"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:4.2-3ubuntu6.21?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:4.2-3ubuntu6.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:4.0+dfsg-0ubuntu9",
        "1:4.0+dfsg-0ubuntu10",
        "1:4.2-1ubuntu1",
        "1:4.2-1ubuntu2",
        "1:4.2-3ubuntu1",
        "1:4.2-3ubuntu2",
        "1:4.2-3ubuntu3",
        "1:4.2-3ubuntu4",
        "1:4.2-3ubuntu5",
        "1:4.2-3ubuntu6",
        "1:4.2-3ubuntu6.1",
        "1:4.2-3ubuntu6.2",
        "1:4.2-3ubuntu6.3",
        "1:4.2-3ubuntu6.4",
        "1:4.2-3ubuntu6.5",
        "1:4.2-3ubuntu6.6",
        "1:4.2-3ubuntu6.7",
        "1:4.2-3ubuntu6.8",
        "1:4.2-3ubuntu6.9",
        "1:4.2-3ubuntu6.10",
        "1:4.2-3ubuntu6.11",
        "1:4.2-3ubuntu6.12",
        "1:4.2-3ubuntu6.14",
        "1:4.2-3ubuntu6.15",
        "1:4.2-3ubuntu6.16",
        "1:4.2-3ubuntu6.17",
        "1:4.2-3ubuntu6.18",
        "1:4.2-3ubuntu6.19"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxencall1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxendevicemodel1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxenevtchn1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxenforeignmemory1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxengnttab1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxenmisc4.11",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxenstore3.0",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxentoolcore1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "libxentoollog1",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.11-amd64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.11-arm64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.11-armhf",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.9-amd64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.9-arm64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-4.9-armhf",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-hypervisor-common",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-system-armhf",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-utils-4.11",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.11.3+24-g14b62ab3e5-1ubuntu2.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.9.2-0ubuntu2",
        "4.9.2-0ubuntu6",
        "4.9.2-0ubuntu7",
        "4.11.3+24-g14b62ab3e5-1ubuntu1",
        "4.11.3+24-g14b62ab3e5-1ubuntu2",
        "4.11.3+24-g14b62ab3e5-1ubuntu2.2",
        "4.11.3+24-g14b62ab3e5-1ubuntu2.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:6.2+dfsg-2ubuntu5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:6.2+dfsg-2ubuntu5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:6.2+dfsg-2ubuntu5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:6.0+dfsg-2expubuntu1",
        "1:6.0+dfsg-2expubuntu2",
        "1:6.0+dfsg-2expubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxencall1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxendevicemodel1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxenevtchn1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxenforeignmemory1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxengnttab1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxenhypfs1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxenmisc4.16",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxenstore4",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxentoolcore1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "libxentoollog1",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-hypervisor-4.16-amd64",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-hypervisor-4.16-arm64",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-hypervisor-4.16-armhf",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-hypervisor-common",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-system-armhf",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-utils-4.16",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.16.0-1~ubuntu2.1"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.16.0-1~ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.16.0-1~ubuntu2.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.11.4+24-gddaaccbbab-1ubuntu2",
        "4.16.0-1~ubuntu2",
        "4.16.0-1~ubuntu2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxencall1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxendevicemodel1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxenevtchn1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxenforeignmemory1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxengnttab1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxenhypfs1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxenmisc4.17t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxenstore4t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxentoolcore1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "libxentoollog1t64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-hypervisor-4.17-amd64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-hypervisor-4.17-arm64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-hypervisor-4.17-armhf",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-hypervisor-common",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-system-armhf",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-utils-4.17",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.17.3+10-g091466ba55-1.1ubuntu3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.17.2-1",
        "4.17.2+55-g0b56bed864-1",
        "4.17.2+76-ge1f9cb16e2-1",
        "4.17.2+76-ge1f9cb16e2-1ubuntu1",
        "4.17.3+10-g091466ba55-1",
        "4.17.3+10-g091466ba55-1.1ubuntu2",
        "4.17.3+10-g091466ba55-1.1ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxencall1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxendevicemodel1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxenevtchn1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxenforeignmemory1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxengnttab1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxenhypfs1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxenmisc4.20",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxenstore4",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxentoolcore1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "libxentoollog1",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-hypervisor-4.20-amd64",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-hypervisor-4.20-arm64",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-hypervisor-common",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-utils-4.20",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.20.0+68-g35cb38b222-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.20.0+68-g35cb38b222-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.20.0-1ubuntu1",
        "4.20.0+68-g35cb38b222-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libxencall1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxendevicemodel1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxenevtchn1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxenforeignmemory1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxengnttab1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxenhypfs1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxenmisc4.20",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxenstore4",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxentoolcore1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "libxentoollog1",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-hypervisor-4.20-amd64",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-hypervisor-4.20-arm64",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-hypervisor-common",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-system-amd64",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-system-arm64",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-utils-4.20",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xen-utils-common",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          },
          {
            "binary_name": "xenstore-utils",
            "binary_version": "4.20.2+7-g1badcf5035-2build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "xen",
        "purl": "pkg:deb/ubuntu/xen@4.20.2+7-g1badcf5035-2build2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.20.0+68-g35cb38b222-1",
        "4.20.2+7-g1badcf5035-2",
        "4.20.2+7-g1badcf5035-2build2"
      ]
    }
  ],
  "aliases": [],
  "details": "A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
  "id": "UBUNTU-CVE-2021-20196",
  "modified": "2026-06-09T19:04:16Z",
  "published": "2021-05-26T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20196"
    },
    {
      "type": "REPORT",
      "url": "https://lists.nongnu.org/archive/html/qemu-devel/2021-01/msg05986.html"
    },
    {
      "type": "REPORT",
      "url": "https://www.openwall.com/lists/oss-security/2021/01/28/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5307-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20196"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8412-1"
    }
  ],
  "related": [
    "USN-5307-1",
    "USN-8412-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-20196"
  ]
}

CVE-2021-20196 (GCVE-0-2021-20196)

Vulnerability from cvelistv5 – Published: 2021-05-26 21:16 – Updated: 2024-08-03 17:30

Summary

Severity

No CVSS data available.

CWE

CWE-476

Assigner

redhat

References

5 references

URL	Tags
https://bugs.launchpad.net/qemu/+bug/1912780	x_refsource_MISC
https://www.openwall.com/lists/oss-security/2021/…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021070…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
n/a	qemu	Affected: vulnerable up to (including) qemu 5.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.781Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/qemu/+bug/1912780"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2021/01/28/1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210708-0004/"
          },
          {
            "name": "[debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html"
          },
          {
            "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "qemu",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "vulnerable up to (including) qemu 5.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-05T05:06:36.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.launchpad.net/qemu/+bug/1912780"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2021/01/28/1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210708-0004/"
        },
        {
          "name": "[debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html"
        },
        {
          "name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20196",
    "datePublished": "2021-05-26T21:16:58.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:30:07.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-5307-1

Vulnerability from osv_ubuntu

Published

2022-02-28 13:03

Modified

2026-04-27 14:11

Summary

qemu vulnerabilities

Details

Gaoning Pan discovered that QEMU incorrectly handled the floppy disk emulator. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20196)

Gaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly handled certain values. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)

It was discovered that the QEMU vhost-user GPU device contained several security issues. An attacker inside the guest could use these issues to cause QEMU to crash, resulting in a denial of service, leak sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)

It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3682)

It was discovered that the QEMU UAS device emulation incorrectly handled certain stream numbers. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3713)

It was discovered that the QEMU virtio-net device incorrectly handled certain buffer addresses. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3748)

It was discovered that the QEMU SCSI device emulation incorrectly handled certain MODE SELECT commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-3930)

It was discovered that the QEMU ACPI logic incorrectly handled certain values. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.10. (CVE-2021-4158)

Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU virtiofsd device incorrectly handled permissions when creating files. An attacker inside the guest could use this issue to create files inside the directory shared by virtiofs with unintended permissions, possibly allowing privilege escalation. This issue only affected Ubuntu 21.10. (CVE-2022-0358)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5307-1	ADVISORY
	https://ubuntu.com/security/CVE-2021-3544	REPORT
	https://ubuntu.com/security/CVE-2021-3545	REPORT
	https://ubuntu.com/security/CVE-2021-3546	REPORT
	https://ubuntu.com/security/CVE-2021-3682	REPORT
	https://ubuntu.com/security/CVE-2021-3713	REPORT
	https://ubuntu.com/security/CVE-2021-3748	REPORT
	https://ubuntu.com/security/CVE-2021-3930	REPORT
	https://ubuntu.com/security/CVE-2021-4158	REPORT
	https://ubuntu.com/security/CVE-2021-20196	REPORT
	https://ubuntu.com/security/CVE-2021-20203	REPORT
	https://ubuntu.com/security/CVE-2022-0358	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-3682",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3748",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3930",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20196",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.11+dfsg-1ubuntu7.39"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:2.11+dfsg-1ubuntu7.39?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.11+dfsg-1ubuntu7.39"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.10+dfsg-0ubuntu3",
        "1:2.10+dfsg-0ubuntu4",
        "1:2.10+dfsg-0ubuntu5",
        "1:2.11+dfsg-1ubuntu1",
        "1:2.11+dfsg-1ubuntu2",
        "1:2.11+dfsg-1ubuntu4",
        "1:2.11+dfsg-1ubuntu5",
        "1:2.11+dfsg-1ubuntu6",
        "1:2.11+dfsg-1ubuntu7",
        "1:2.11+dfsg-1ubuntu7.1",
        "1:2.11+dfsg-1ubuntu7.2",
        "1:2.11+dfsg-1ubuntu7.3",
        "1:2.11+dfsg-1ubuntu7.4",
        "1:2.11+dfsg-1ubuntu7.5",
        "1:2.11+dfsg-1ubuntu7.6",
        "1:2.11+dfsg-1ubuntu7.7",
        "1:2.11+dfsg-1ubuntu7.8",
        "1:2.11+dfsg-1ubuntu7.9",
        "1:2.11+dfsg-1ubuntu7.10",
        "1:2.11+dfsg-1ubuntu7.12",
        "1:2.11+dfsg-1ubuntu7.13",
        "1:2.11+dfsg-1ubuntu7.14",
        "1:2.11+dfsg-1ubuntu7.15",
        "1:2.11+dfsg-1ubuntu7.17",
        "1:2.11+dfsg-1ubuntu7.18",
        "1:2.11+dfsg-1ubuntu7.19",
        "1:2.11+dfsg-1ubuntu7.20",
        "1:2.11+dfsg-1ubuntu7.21",
        "1:2.11+dfsg-1ubuntu7.22",
        "1:2.11+dfsg-1ubuntu7.23",
        "1:2.11+dfsg-1ubuntu7.25",
        "1:2.11+dfsg-1ubuntu7.26",
        "1:2.11+dfsg-1ubuntu7.27",
        "1:2.11+dfsg-1ubuntu7.28",
        "1:2.11+dfsg-1ubuntu7.29",
        "1:2.11+dfsg-1ubuntu7.31",
        "1:2.11+dfsg-1ubuntu7.32",
        "1:2.11+dfsg-1ubuntu7.33",
        "1:2.11+dfsg-1ubuntu7.34",
        "1:2.11+dfsg-1ubuntu7.35",
        "1:2.11+dfsg-1ubuntu7.36",
        "1:2.11+dfsg-1ubuntu7.37",
        "1:2.11+dfsg-1ubuntu7.38"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-3682",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3748",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3930",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20196",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:4.2-3ubuntu6.21"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:4.2-3ubuntu6.21"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:4.2-3ubuntu6.21?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:4.2-3ubuntu6.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:4.0+dfsg-0ubuntu9",
        "1:4.0+dfsg-0ubuntu10",
        "1:4.2-1ubuntu1",
        "1:4.2-1ubuntu2",
        "1:4.2-3ubuntu1",
        "1:4.2-3ubuntu2",
        "1:4.2-3ubuntu3",
        "1:4.2-3ubuntu4",
        "1:4.2-3ubuntu5",
        "1:4.2-3ubuntu6",
        "1:4.2-3ubuntu6.1",
        "1:4.2-3ubuntu6.2",
        "1:4.2-3ubuntu6.3",
        "1:4.2-3ubuntu6.4",
        "1:4.2-3ubuntu6.5",
        "1:4.2-3ubuntu6.6",
        "1:4.2-3ubuntu6.7",
        "1:4.2-3ubuntu6.8",
        "1:4.2-3ubuntu6.9",
        "1:4.2-3ubuntu6.10",
        "1:4.2-3ubuntu6.11",
        "1:4.2-3ubuntu6.12",
        "1:4.2-3ubuntu6.14",
        "1:4.2-3ubuntu6.15",
        "1:4.2-3ubuntu6.16",
        "1:4.2-3ubuntu6.17",
        "1:4.2-3ubuntu6.18",
        "1:4.2-3ubuntu6.19"
      ]
    }
  ],
  "aliases": [],
  "details": "Gaoning Pan discovered that QEMU incorrectly handled the floppy disk\nemulator. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2021-20196)\n\nGaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly\nhandled certain values. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)\n\nIt was discovered that the QEMU vhost-user GPU device contained several\nsecurity issues. An attacker inside the guest could use these issues to\ncause QEMU to crash, resulting in a denial of service, leak sensitive\ninformation, or possibly execute arbitrary code. This issue only affected\nUbuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)\n\nIt was discovered that QEMU incorrectly handled bulk transfers from SPICE\nclients. A remote attacker could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2021-3682)\n\nIt was discovered that the QEMU UAS device emulation incorrectly handled\ncertain stream numbers. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 21.10.\n(CVE-2021-3713)\n\nIt was discovered that the QEMU virtio-net device incorrectly handled\ncertain buffer addresses. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.  (CVE-2021-3748)\n\nIt was discovered that the QEMU SCSI device emulation incorrectly handled\ncertain MODE SELECT commands. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2021-3930)\n\nIt was discovered that the QEMU ACPI logic incorrectly handled certain\nvalues. An attacker inside the guest could possibly use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only affected\nUbuntu 21.10. (CVE-2021-4158)\n\nJietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU\nvirtiofsd device incorrectly handled permissions when creating files. An\nattacker inside the guest could use this issue to create files inside the\ndirectory shared by virtiofs with unintended permissions, possibly allowing\nprivilege escalation. This issue only affected Ubuntu 21.10.\n(CVE-2022-0358)\n",
  "id": "USN-5307-1",
  "modified": "2026-04-27T14:11:27Z",
  "published": "2022-02-28T13:03:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5307-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3544"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3545"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3546"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3682"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3713"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3748"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3930"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4158"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20196"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-0358"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "qemu vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-3544",
    "UBUNTU-CVE-2021-3545",
    "UBUNTU-CVE-2021-3546",
    "UBUNTU-CVE-2021-3682",
    "UBUNTU-CVE-2021-3713",
    "UBUNTU-CVE-2021-3748",
    "UBUNTU-CVE-2021-3930",
    "UBUNTU-CVE-2021-4158",
    "UBUNTU-CVE-2021-20196",
    "UBUNTU-CVE-2021-20203",
    "UBUNTU-CVE-2022-0358"
  ]
}

usn-8412-1

Vulnerability from osv_ubuntu

Published

2026-06-09 16:22

Modified

2026-06-16 23:36

Summary

qemu vulnerabilities

Details

Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations, leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2020-14394)

Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-15469)

Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-17380)

Sergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the USB xHCI controller implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25624)

It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures, leading to a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25723)

Gaoning Pan discovered that the network device emulation in QEMU could be made to trigger an assertion failure when processing packets that lacked a valid layer 3 protocol. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-27617)

Wenxiang Qian discovered that the ATAPI emulation in QEMU did not properly validate a buffer index, leading to an out-of-bounds read. An attacker inside the guest could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-29443)

Cheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)

Cheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35505)

It was discovered that the SDHCI controller emulation in QEMU contained out-of-bounds read and write issues. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3409)

It was discovered that several network device emulations in QEMU contained an infinite loop when operating in loopback mode. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3416)

Alexander Bulekov discovered that the floppy disk emulation in QEMU contained a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3507)

Remy Noel discovered that the USB redirector device emulation in QEMU performed an unbounded stack allocation when combining USB packets. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3527)

It was discovered that the QXL display device emulation in QEMU contained an integer overflow, leading to a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)

It was discovered that the QXL display device emulation in QEMU performed a double fetch of guest-controlled values, leading to a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4207)

It was discovered that the 9pfs server implementation in QEMU contained a race condition, leading to a use-after-free. A malicious 9p client could possibly use this issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-20181)

Gaoning Pan discovered that the floppy disk emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)

Gaoning Pan discovered that the vmxnet3 network device emulation in QEMU contained an integer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20203)

It was discovered that the ARM Generic Interrupt Controller emulation in QEMU contained an out-of-bounds heap access. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20221)

Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the e1000 network device emulation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20257)

It was discovered that the 9p passthrough file system implementation in QEMU did not prevent opening special files on the host. A malicious guest could possibly use this issue to escape the exported 9p tree. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-2861)

It was discovered that the virtio crypto device emulation in QEMU did not properly validate certain buffer lengths, leading to a heap buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3180)

It was discovered that the built-in VNC server in QEMU contained a NULL pointer dereference when cleaning up a connection that failed during the handshake. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3354)

It was discovered that QEMU could incorrectly direct a guest I/O operation to disk offset 0 instead of the intended offset. An attacker inside the guest could possibly use this issue to read or overwrite sensitive data, potentially gaining control of the host. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)

It was discovered that several virtio device emulations in QEMU did not properly guard against DMA reentrancy, leading to a double free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-3446)

It was discovered that the SDHCI device emulation in QEMU contained a heap- based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-3447)

It was discovered that the QEMU disk image utility (qemu-img) did not properly handle certain crafted image files. An attacker could possibly use this issue to cause qemu-img to consume excessive resources or access an unintended external file, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2024-4467)

Cyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter emulation in QEMU contained a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519)

It was discovered that the NBD server in QEMU contained an improper synchronization issue during socket closure. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-7409)

It was discovered that the USB emulation in QEMU contained a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled resources during the VNC WebSocket handshake, leading to a use-after-free. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-11234)

It was discovered that QEMU could be made to read out of bounds when reading VMDK images. An attacker could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. (CVE-2026-2243)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8412-1	ADVISORY
	https://ubuntu.com/security/CVE-2020-1711	REPORT
	https://ubuntu.com/security/CVE-2020-11947	REPORT
	https://ubuntu.com/security/CVE-2020-12829	REPORT
	https://ubuntu.com/security/CVE-2020-14394	REPORT
	https://ubuntu.com/security/CVE-2020-15469	REPORT
	https://ubuntu.com/security/CVE-2020-15859	REPORT
	https://ubuntu.com/security/CVE-2020-15863	REPORT
	https://ubuntu.com/security/CVE-2020-17380	REPORT
	https://ubuntu.com/security/CVE-2020-25084	REPORT
	https://ubuntu.com/security/CVE-2020-25624	REPORT
	https://ubuntu.com/security/CVE-2020-25625	REPORT
	https://ubuntu.com/security/CVE-2020-25723	REPORT
	https://ubuntu.com/security/CVE-2020-27617	REPORT
	https://ubuntu.com/security/CVE-2020-29443	REPORT
	https://ubuntu.com/security/CVE-2020-35504	REPORT
	https://ubuntu.com/security/CVE-2020-35505	REPORT
	https://ubuntu.com/security/CVE-2021-3409	REPORT
	https://ubuntu.com/security/CVE-2021-3416	REPORT
	https://ubuntu.com/security/CVE-2021-3507	REPORT
	https://ubuntu.com/security/CVE-2021-3527	REPORT
	https://ubuntu.com/security/CVE-2021-4206	REPORT
	https://ubuntu.com/security/CVE-2021-4207	REPORT
	https://ubuntu.com/security/CVE-2021-20181	REPORT
	https://ubuntu.com/security/CVE-2021-20196	REPORT
	https://ubuntu.com/security/CVE-2021-20203	REPORT
	https://ubuntu.com/security/CVE-2021-20221	REPORT
	https://ubuntu.com/security/CVE-2021-20257	REPORT
	https://ubuntu.com/security/CVE-2023-2861	REPORT
	https://ubuntu.com/security/CVE-2023-3180	REPORT
	https://ubuntu.com/security/CVE-2023-3354	REPORT
	https://ubuntu.com/security/CVE-2023-5088	REPORT
	https://ubuntu.com/security/CVE-2024-3446	REPORT
	https://ubuntu.com/security/CVE-2024-3447	REPORT
	https://ubuntu.com/security/CVE-2024-4467	REPORT
	https://ubuntu.com/security/CVE-2024-6519	REPORT
	https://ubuntu.com/security/CVE-2024-7409	REPORT
	https://ubuntu.com/security/CVE-2024-8354	REPORT
	https://ubuntu.com/security/CVE-2025-11234	REPORT
	https://ubuntu.com/security/CVE-2026-2243	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-1711",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-11947",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-12829",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-14394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-15469",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-15859",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-15863",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-17380",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-25084",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-25624",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-25625",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-25723",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-27617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-29443",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-35504",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-35505",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3409",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3416",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3507",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3527",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4206",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20181",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20196",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20221",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20257",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-2861",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-5088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3447",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-6519",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-7409",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-8354",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-keymaps",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@2.0.0+dfsg-2ubuntu1.47+esm6?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0+dfsg-2ubuntu1.47+esm6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.0+dfsg-3ubuntu5",
        "1.5.0+dfsg-3ubuntu6",
        "1.6.0+dfsg-2ubuntu1",
        "1.6.0+dfsg-2ubuntu2",
        "1.6.0+dfsg-2ubuntu3",
        "1.6.0+dfsg-2ubuntu4",
        "1.7.0+dfsg-2ubuntu1",
        "1.7.0+dfsg-2ubuntu2",
        "1.7.0+dfsg-2ubuntu3",
        "1.7.0+dfsg-2ubuntu4",
        "1.7.0+dfsg-2ubuntu5",
        "1.7.0+dfsg-2ubuntu7",
        "1.7.0+dfsg-2ubuntu8",
        "1.7.0+dfsg-2ubuntu9",
        "1.7.0+dfsg-3ubuntu1~ppa1",
        "1.7.0+dfsg-3ubuntu1",
        "1.7.0+dfsg-3ubuntu2",
        "1.7.0+dfsg-3ubuntu3",
        "1.7.0+dfsg-3ubuntu4",
        "1.7.0+dfsg-3ubuntu5",
        "1.7.0+dfsg-3ubuntu6",
        "1.7.0+dfsg-3ubuntu7",
        "2.0.0~rc1+dfsg-0ubuntu1",
        "2.0.0~rc1+dfsg-0ubuntu2",
        "2.0.0~rc1+dfsg-0ubuntu3",
        "2.0.0~rc1+dfsg-0ubuntu3.1",
        "2.0.0+dfsg-2ubuntu1",
        "2.0.0+dfsg-2ubuntu1.1",
        "2.0.0+dfsg-2ubuntu1.2",
        "2.0.0+dfsg-2ubuntu1.3",
        "2.0.0+dfsg-2ubuntu1.5",
        "2.0.0+dfsg-2ubuntu1.6",
        "2.0.0+dfsg-2ubuntu1.7",
        "2.0.0+dfsg-2ubuntu1.8",
        "2.0.0+dfsg-2ubuntu1.9",
        "2.0.0+dfsg-2ubuntu1.10",
        "2.0.0+dfsg-2ubuntu1.11",
        "2.0.0+dfsg-2ubuntu1.13",
        "2.0.0+dfsg-2ubuntu1.14",
        "2.0.0+dfsg-2ubuntu1.15",
        "2.0.0+dfsg-2ubuntu1.16",
        "2.0.0+dfsg-2ubuntu1.17",
        "2.0.0+dfsg-2ubuntu1.18",
        "2.0.0+dfsg-2ubuntu1.19",
        "2.0.0+dfsg-2ubuntu1.20",
        "2.0.0+dfsg-2ubuntu1.21",
        "2.0.0+dfsg-2ubuntu1.22",
        "2.0.0+dfsg-2ubuntu1.24",
        "2.0.0+dfsg-2ubuntu1.25",
        "2.0.0+dfsg-2ubuntu1.26",
        "2.0.0+dfsg-2ubuntu1.27",
        "2.0.0+dfsg-2ubuntu1.28",
        "2.0.0+dfsg-2ubuntu1.29",
        "2.0.0+dfsg-2ubuntu1.30",
        "2.0.0+dfsg-2ubuntu1.31",
        "2.0.0+dfsg-2ubuntu1.32",
        "2.0.0+dfsg-2ubuntu1.33",
        "2.0.0+dfsg-2ubuntu1.34",
        "2.0.0+dfsg-2ubuntu1.35",
        "2.0.0+dfsg-2ubuntu1.36",
        "2.0.0+dfsg-2ubuntu1.38",
        "2.0.0+dfsg-2ubuntu1.39",
        "2.0.0+dfsg-2ubuntu1.40",
        "2.0.0+dfsg-2ubuntu1.41",
        "2.0.0+dfsg-2ubuntu1.42",
        "2.0.0+dfsg-2ubuntu1.43",
        "2.0.0+dfsg-2ubuntu1.44",
        "2.0.0+dfsg-2ubuntu1.45",
        "2.0.0+dfsg-2ubuntu1.46",
        "2.0.0+dfsg-2ubuntu1.47",
        "2.0.0+dfsg-2ubuntu1.47+esm1",
        "2.0.0+dfsg-2ubuntu1.47+esm2",
        "2.0.0+dfsg-2ubuntu1.47+esm3",
        "2.0.0+dfsg-2ubuntu1.47+esm4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-14394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-15469",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-35504",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-35505",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3409",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3416",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3507",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3527",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4206",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20196",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20221",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-20257",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-2861",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-5088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3447",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-6519",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-7409",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-8354",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:2.5+dfsg-5ubuntu10.51+esm4?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.5+dfsg-5ubuntu10.51+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3+dfsg-5ubuntu9",
        "1:2.3+dfsg-5ubuntu10",
        "1:2.4+dfsg-4ubuntu1",
        "1:2.4+dfsg-4ubuntu2",
        "1:2.4+dfsg-4ubuntu3",
        "1:2.4+dfsg-5ubuntu3",
        "1:2.5+dfsg-1ubuntu2",
        "1:2.5+dfsg-1ubuntu3",
        "1:2.5+dfsg-1ubuntu4",
        "1:2.5+dfsg-1ubuntu5",
        "1:2.5+dfsg-5ubuntu1",
        "1:2.5+dfsg-5ubuntu2",
        "1:2.5+dfsg-5ubuntu4",
        "1:2.5+dfsg-5ubuntu6",
        "1:2.5+dfsg-5ubuntu7",
        "1:2.5+dfsg-5ubuntu10",
        "1:2.5+dfsg-5ubuntu10.1",
        "1:2.5+dfsg-5ubuntu10.2",
        "1:2.5+dfsg-5ubuntu10.3",
        "1:2.5+dfsg-5ubuntu10.4",
        "1:2.5+dfsg-5ubuntu10.5",
        "1:2.5+dfsg-5ubuntu10.6",
        "1:2.5+dfsg-5ubuntu10.7",
        "1:2.5+dfsg-5ubuntu10.8",
        "1:2.5+dfsg-5ubuntu10.9",
        "1:2.5+dfsg-5ubuntu10.10",
        "1:2.5+dfsg-5ubuntu10.11",
        "1:2.5+dfsg-5ubuntu10.13",
        "1:2.5+dfsg-5ubuntu10.14",
        "1:2.5+dfsg-5ubuntu10.15",
        "1:2.5+dfsg-5ubuntu10.16",
        "1:2.5+dfsg-5ubuntu10.20",
        "1:2.5+dfsg-5ubuntu10.21",
        "1:2.5+dfsg-5ubuntu10.22",
        "1:2.5+dfsg-5ubuntu10.24",
        "1:2.5+dfsg-5ubuntu10.25",
        "1:2.5+dfsg-5ubuntu10.26",
        "1:2.5+dfsg-5ubuntu10.28",
        "1:2.5+dfsg-5ubuntu10.29",
        "1:2.5+dfsg-5ubuntu10.30",
        "1:2.5+dfsg-5ubuntu10.31",
        "1:2.5+dfsg-5ubuntu10.32",
        "1:2.5+dfsg-5ubuntu10.33",
        "1:2.5+dfsg-5ubuntu10.34",
        "1:2.5+dfsg-5ubuntu10.35",
        "1:2.5+dfsg-5ubuntu10.36",
        "1:2.5+dfsg-5ubuntu10.37",
        "1:2.5+dfsg-5ubuntu10.38",
        "1:2.5+dfsg-5ubuntu10.39",
        "1:2.5+dfsg-5ubuntu10.40",
        "1:2.5+dfsg-5ubuntu10.41",
        "1:2.5+dfsg-5ubuntu10.42",
        "1:2.5+dfsg-5ubuntu10.43",
        "1:2.5+dfsg-5ubuntu10.44",
        "1:2.5+dfsg-5ubuntu10.45",
        "1:2.5+dfsg-5ubuntu10.46",
        "1:2.5+dfsg-5ubuntu10.47",
        "1:2.5+dfsg-5ubuntu10.48",
        "1:2.5+dfsg-5ubuntu10.49",
        "1:2.5+dfsg-5ubuntu10.51",
        "1:2.5+dfsg-5ubuntu10.51+esm1",
        "1:2.5+dfsg-5ubuntu10.51+esm2",
        "1:2.5+dfsg-5ubuntu10.51+esm3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-14394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-2861",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-3180",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-3354",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-5088",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3447",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-6519",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-8354",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-11234",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:2.11+dfsg-1ubuntu7.42+esm5?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.11+dfsg-1ubuntu7.42+esm5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.10+dfsg-0ubuntu3",
        "1:2.10+dfsg-0ubuntu4",
        "1:2.10+dfsg-0ubuntu5",
        "1:2.11+dfsg-1ubuntu1",
        "1:2.11+dfsg-1ubuntu2",
        "1:2.11+dfsg-1ubuntu4",
        "1:2.11+dfsg-1ubuntu5",
        "1:2.11+dfsg-1ubuntu6",
        "1:2.11+dfsg-1ubuntu7",
        "1:2.11+dfsg-1ubuntu7.1",
        "1:2.11+dfsg-1ubuntu7.2",
        "1:2.11+dfsg-1ubuntu7.3",
        "1:2.11+dfsg-1ubuntu7.4",
        "1:2.11+dfsg-1ubuntu7.5",
        "1:2.11+dfsg-1ubuntu7.6",
        "1:2.11+dfsg-1ubuntu7.7",
        "1:2.11+dfsg-1ubuntu7.8",
        "1:2.11+dfsg-1ubuntu7.9",
        "1:2.11+dfsg-1ubuntu7.10",
        "1:2.11+dfsg-1ubuntu7.12",
        "1:2.11+dfsg-1ubuntu7.13",
        "1:2.11+dfsg-1ubuntu7.14",
        "1:2.11+dfsg-1ubuntu7.15",
        "1:2.11+dfsg-1ubuntu7.17",
        "1:2.11+dfsg-1ubuntu7.18",
        "1:2.11+dfsg-1ubuntu7.19",
        "1:2.11+dfsg-1ubuntu7.20",
        "1:2.11+dfsg-1ubuntu7.21",
        "1:2.11+dfsg-1ubuntu7.22",
        "1:2.11+dfsg-1ubuntu7.23",
        "1:2.11+dfsg-1ubuntu7.25",
        "1:2.11+dfsg-1ubuntu7.26",
        "1:2.11+dfsg-1ubuntu7.27",
        "1:2.11+dfsg-1ubuntu7.28",
        "1:2.11+dfsg-1ubuntu7.29",
        "1:2.11+dfsg-1ubuntu7.31",
        "1:2.11+dfsg-1ubuntu7.32",
        "1:2.11+dfsg-1ubuntu7.33",
        "1:2.11+dfsg-1ubuntu7.34",
        "1:2.11+dfsg-1ubuntu7.35",
        "1:2.11+dfsg-1ubuntu7.36",
        "1:2.11+dfsg-1ubuntu7.37",
        "1:2.11+dfsg-1ubuntu7.38",
        "1:2.11+dfsg-1ubuntu7.39",
        "1:2.11+dfsg-1ubuntu7.40",
        "1:2.11+dfsg-1ubuntu7.41",
        "1:2.11+dfsg-1ubuntu7.42",
        "1:2.11+dfsg-1ubuntu7.42+esm1",
        "1:2.11+dfsg-1ubuntu7.42+esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-3446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-3447",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-4467",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-6519",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-8354",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-11234",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-2243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-kvm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:4.2-3ubuntu6.30+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:4.2-3ubuntu6.30+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:4.0+dfsg-0ubuntu9",
        "1:4.0+dfsg-0ubuntu10",
        "1:4.2-1ubuntu1",
        "1:4.2-1ubuntu2",
        "1:4.2-3ubuntu1",
        "1:4.2-3ubuntu2",
        "1:4.2-3ubuntu3",
        "1:4.2-3ubuntu4",
        "1:4.2-3ubuntu5",
        "1:4.2-3ubuntu6",
        "1:4.2-3ubuntu6.1",
        "1:4.2-3ubuntu6.2",
        "1:4.2-3ubuntu6.3",
        "1:4.2-3ubuntu6.4",
        "1:4.2-3ubuntu6.5",
        "1:4.2-3ubuntu6.6",
        "1:4.2-3ubuntu6.7",
        "1:4.2-3ubuntu6.8",
        "1:4.2-3ubuntu6.9",
        "1:4.2-3ubuntu6.10",
        "1:4.2-3ubuntu6.11",
        "1:4.2-3ubuntu6.12",
        "1:4.2-3ubuntu6.14",
        "1:4.2-3ubuntu6.15",
        "1:4.2-3ubuntu6.16",
        "1:4.2-3ubuntu6.17",
        "1:4.2-3ubuntu6.18",
        "1:4.2-3ubuntu6.19",
        "1:4.2-3ubuntu6.21",
        "1:4.2-3ubuntu6.23",
        "1:4.2-3ubuntu6.24",
        "1:4.2-3ubuntu6.25",
        "1:4.2-3ubuntu6.26",
        "1:4.2-3ubuntu6.27",
        "1:4.2-3ubuntu6.28",
        "1:4.2-3ubuntu6.29",
        "1:4.2-3ubuntu6.30"
      ]
    }
  ],
  "aliases": [],
  "details": "Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the\niSCSI block driver in QEMU incorrectly handled certain responses from an\niSCSI server. A remote attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)\n\nIt was discovered that the iSCSI block driver in QEMU incorrectly handled\ncertain memory operations, leading to a heap-based buffer over-read. An\nattacker could possibly use this issue to expose sensitive information from\nthe host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)\n\nZiming Zhang discovered that the SM501 display driver in QEMU contained an\ninteger overflow. A local attacker could possibly use this issue to cause\nQEMU to crash, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS. (CVE-2020-12829)\n\nGaoning Pan and Xingwei Li discovered that the USB xHCI controller\nimplementation in QEMU contained an infinite loop. An attacker inside the\nguest could possibly use this issue to cause QEMU to hang, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04\nLTS, and Ubuntu 18.04 LTS. (CVE-2020-14394)\n\nLei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps\nobjects, leading to a NULL pointer dereference. An attacker inside the\nguest could possibly use this issue to cause QEMU to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2020-15469)\n\nAlexander Bulekov discovered that the e1000e network device implementation\nin QEMU contained a use-after-free. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)\n\nZiming Zhang discovered that the XGMAC Ethernet controller in QEMU\ncontained a buffer overflow. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2020-15863)\n\nAlexander Bulekov discovered that the SDHCI device emulation in QEMU\ncontained a heap-based buffer overflow. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS. (CVE-2020-17380)\n\nSergej Schumilo, Cornelius Aschermann, and Simon W\u00f6rner discovered that the\nUSB xHCI controller implementation in QEMU did not check a return value,\nleading to a use-after-free. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2020-25084)\n\nGaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI\ncontroller implementation in QEMU contained a stack-based buffer over-read.\nAn attacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS. (CVE-2020-25624)\n\nIt was discovered that the USB OHCI controller implementation in QEMU\ncontained an infinite loop. An attacker inside the guest could possibly use\nthis issue to cause QEMU to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)\n\nCheolwoo Myung discovered that the USB EHCI emulation in QEMU did not\nhandle DMA memory map failures, leading to a reachable assertion. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS. (CVE-2020-25723)\n\nGaoning Pan discovered that the network device emulation in QEMU could be\nmade to trigger an assertion failure when processing packets that lacked a\nvalid layer 3 protocol. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2020-27617)\n\nWenxiang Qian discovered that the ATAPI emulation in QEMU did not properly\nvalidate a buffer index, leading to an out-of-bounds read. An attacker\ninside the guest could possibly use this issue to expose sensitive\ninformation or cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2020-29443)\n\nCheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a\nNULL pointer dereference. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)\n\nCheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation\nin QEMU contained a NULL pointer dereference. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2020-35505)\n\nIt was discovered that the SDHCI controller emulation in QEMU contained\nout-of-bounds read and write issues. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3409)\n\nIt was discovered that several network device emulations in QEMU contained\nan infinite loop when operating in loopback mode. An attacker inside the\nguest could possibly use this issue to cause QEMU to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2021-3416)\n\nAlexander Bulekov discovered that the floppy disk emulation in QEMU\ncontained a heap-based buffer overflow. An attacker inside the guest could\npossibly use this issue to expose sensitive information or cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3507)\n\nRemy Noel discovered that the USB redirector device emulation in QEMU\nperformed an unbounded stack allocation when combining USB packets. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3527)\n\nIt was discovered that the QXL display device emulation in QEMU contained\nan integer overflow, leading to a heap-based buffer overflow. An attacker\ninside the guest could possibly use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)\n\nIt was discovered that the QXL display device emulation in QEMU performed a\ndouble fetch of guest-controlled values, leading to a heap-based buffer\noverflow. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04\nLTS. (CVE-2021-4207)\n\nIt was discovered that the 9pfs server implementation in QEMU contained a\nrace condition, leading to a use-after-free. A malicious 9p client could\npossibly use this issue to escalate privileges. This issue only affected\nUbuntu 14.04 LTS. (CVE-2021-20181)\n\nGaoning Pan discovered that the floppy disk emulation in QEMU contained a\nNULL pointer dereference. An attacker inside the guest could possibly use\nthis issue to cause QEMU to crash, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)\n\nGaoning Pan discovered that the vmxnet3 network device emulation in QEMU\ncontained an integer overflow. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20203)\n\nIt was discovered that the ARM Generic Interrupt Controller emulation in\nQEMU contained an out-of-bounds heap access. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20221)\n\nAlexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann,\nand Simon W\u00f6rner discovered that the e1000 network device emulation in QEMU\ncontained an infinite loop. An attacker inside the guest could possibly use\nthis issue to cause QEMU to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2021-20257)\n\nIt was discovered that the 9p passthrough file system implementation in\nQEMU did not prevent opening special files on the host. A malicious guest\ncould possibly use this issue to escape the exported 9p tree. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2023-2861)\n\nIt was discovered that the virtio crypto device emulation in QEMU did not\nproperly validate certain buffer lengths, leading to a heap buffer\noverflow. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3180)\n\nIt was discovered that the built-in VNC server in QEMU contained a NULL\npointer dereference when cleaning up a connection that failed during the\nhandshake. A remote attacker could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n18.04 LTS. (CVE-2023-3354)\n\nIt was discovered that QEMU could incorrectly direct a guest I/O operation\nto disk offset 0 instead of the intended offset. An attacker inside the\nguest could possibly use this issue to read or overwrite sensitive data,\npotentially gaining control of the host. This issue only affected Ubuntu\n14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)\n\nIt was discovered that several virtio device emulations in QEMU did not\nproperly guard against DMA reentrancy, leading to a double free. An\nattacker inside the guest could possibly use this issue to cause QEMU to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2024-3446)\n\nIt was discovered that the SDHCI device emulation in QEMU contained a heap-\nbased buffer overflow. An attacker inside the guest could possibly use this\nissue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2024-3447)\n\nIt was discovered that the QEMU disk image utility (qemu-img) did not\nproperly handle certain crafted image files. An attacker could possibly use\nthis issue to cause qemu-img to consume excessive resources or access an\nunintended external file, resulting in a denial of service. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2024-4467)\n\nCyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter\nemulation in QEMU contained a use-after-free. An attacker inside the guest\ncould possibly use this issue to cause QEMU to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2024-6519)\n\nIt was discovered that the NBD server in QEMU contained an improper\nsynchronization issue during socket closure. A remote attacker could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. (CVE-2024-7409)\n\nIt was discovered that the USB emulation in QEMU contained a reachable\nassertion. An attacker inside the guest could possibly use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)\n\nIt was discovered that QEMU incorrectly handled resources during the VNC\nWebSocket handshake, leading to a use-after-free. A remote attacker could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2025-11234)\n\nIt was discovered that QEMU could be made to read out of bounds when\nreading VMDK images. An attacker could possibly use this issue to expose\nsensitive information or cause QEMU to crash, resulting in a denial of\nservice. (CVE-2026-2243)",
  "id": "USN-8412-1",
  "modified": "2026-06-16T23:36:34Z",
  "published": "2026-06-09T16:22:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8412-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-1711"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-11947"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-12829"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-14394"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-15469"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-15859"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-15863"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-17380"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25084"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25624"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25625"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25723"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-29443"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-35504"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-35505"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3409"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3416"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3507"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3527"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4206"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4207"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20181"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20196"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20221"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20257"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-2861"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-3180"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-3354"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-5088"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-3446"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-3447"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-4467"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-6519"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-7409"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-8354"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-11234"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-2243"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "qemu vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2020-1711",
    "UBUNTU-CVE-2020-11947",
    "UBUNTU-CVE-2020-12829",
    "UBUNTU-CVE-2020-14394",
    "UBUNTU-CVE-2020-15469",
    "UBUNTU-CVE-2020-15859",
    "UBUNTU-CVE-2020-15863",
    "UBUNTU-CVE-2020-17380",
    "UBUNTU-CVE-2020-25084",
    "UBUNTU-CVE-2020-25624",
    "UBUNTU-CVE-2020-25625",
    "UBUNTU-CVE-2020-25723",
    "UBUNTU-CVE-2020-27617",
    "UBUNTU-CVE-2020-29443",
    "UBUNTU-CVE-2020-35504",
    "UBUNTU-CVE-2020-35505",
    "UBUNTU-CVE-2021-3409",
    "UBUNTU-CVE-2021-3416",
    "UBUNTU-CVE-2021-3507",
    "UBUNTU-CVE-2021-3527",
    "UBUNTU-CVE-2021-4206",
    "UBUNTU-CVE-2021-4207",
    "UBUNTU-CVE-2021-20181",
    "UBUNTU-CVE-2021-20196",
    "UBUNTU-CVE-2021-20203",
    "UBUNTU-CVE-2021-20221",
    "UBUNTU-CVE-2021-20257",
    "UBUNTU-CVE-2023-2861",
    "UBUNTU-CVE-2023-3180",
    "UBUNTU-CVE-2023-3354",
    "UBUNTU-CVE-2023-5088",
    "UBUNTU-CVE-2024-3446",
    "UBUNTU-CVE-2024-3447",
    "UBUNTU-CVE-2024-4467",
    "UBUNTU-CVE-2024-6519",
    "UBUNTU-CVE-2024-7409",
    "UBUNTU-CVE-2024-8354",
    "UBUNTU-CVE-2025-11234",
    "UBUNTU-CVE-2026-2243"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2021-20196

Vulnerability from osv_ubuntu

CVE-2021-20196 (GCVE-0-2021-20196)

usn-5307-1

Vulnerability from osv_ubuntu

usn-8412-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature