GCVE - cpe:2.3:a:qemu:qemu:4.0.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qemu:qemu:4.0.0:*:*:*:*:*:*:*

part: a version: 4.0.0 update: *

Vendor	Qemu (`dc79796f-803a-5e2c-8ac2-933a08531b40`)
Product	Qemu (`741928e6-f439-57f2-bcb7-48ccc5351068`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/qemu/qemu`	purl2cpe	2026-06-01 10:18:03.885106
`pkg:gitlab/qemu-project/qemu`	purl2cpe	2026-06-01 10:18:03.885108

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-13765`	vulnerable	2026-06-08 05:18:01.064885	Details available rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. Published: 2020-06-04T15:26:17.000Z Updated: 2024-08-04T12:25:16.492Z Open on db.gcve.eu Reference links https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319 https://www.openwall.com/lists/oss-security/2020/06/03/6 https://security.netapp.com/advisory/ntap-20200619-0006/ https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-15034`	vulnerable	2026-06-08 05:12:56.579730	Details available hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space. Published: 2020-03-10T17:19:02.000Z Updated: 2024-08-05T00:34:53.171Z Open on db.gcve.eu Reference links https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01959.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html https://www.debian.org/security/2020/dsa-4665 https://usn.ubuntu.com/4372-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13164`	vulnerable	2026-06-08 05:12:41.362965	Details available qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass. Published: 2019-07-03T13:56:52.000Z Updated: 2024-08-04T23:41:10.520Z Open on db.gcve.eu Reference links https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00145.html http://www.openwall.com/lists/oss-security/2019/07/02/2 http://www.openwall.com/lists/oss-security/2019/07/02/2 http://www.securityfocus.com/bid/109054 https://seclists.org/bugtraq/2019/Aug/41	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12155`	vulnerable	2026-06-08 05:12:38.611715	Details available interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. Published: 2019-05-24T15:33:11.000Z Updated: 2024-08-04T23:10:30.831Z Open on db.gcve.eu Reference links https://lists.gnu.org/archive/html/qemu-devel/2019-05/msg01321.html http://www.openwall.com/lists/oss-security/2019/05/22/1 https://www.debian.org/security/2019/dsa-4454 https://seclists.org/bugtraq/2019/May/76 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.