GCVE - cpe:2.3:a:qemu:qemu:3.1.0:rc2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qemu:qemu:3.1.0:rc2:*:*:*:*:*:*

part: a version: 3.1.0 update: rc2

Vendor	Qemu (`dc79796f-803a-5e2c-8ac2-933a08531b40`)
Product	Qemu (`741928e6-f439-57f2-bcb7-48ccc5351068`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/qemu/qemu`	purl2cpe	2026-06-01 10:18:03.885087
`pkg:gitlab/qemu-project/qemu`	purl2cpe	2026-06-01 10:18:03.885089

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-19489`	vulnerable	2026-06-08 05:11:15.793488	Details available v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming. Published: 2018-12-13T19:00:00.000Z Updated: 2024-08-05T11:37:11.447Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2018/11/26/1 https://lists.debian.org/debian-lts-announce/2019/01/msg00023.html https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg04489.html https://security-tracker.debian.org/tracker/CVE-2018-19489 https://exchange.xforce.ibmcloud.com/vulnerabilities/153326	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-17963`	vulnerable	2026-06-08 05:11:07.058691	Details available qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. Published: 2018-10-09T22:00:00.000Z Updated: 2024-08-05T11:01:14.685Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2018/10/08/1 https://www.debian.org/security/2018/dsa-4338 https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html https://usn.ubuntu.com/3826-1/ https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-16867`	vulnerable	2026-06-08 05:11:05.652531	Details available HIGH (7) A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host. Published: 2018-12-12T13:00:00.000Z Updated: 2024-08-05T10:32:54.050Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16867 http://www.securityfocus.com/bid/106195 https://www.openwall.com/lists/oss-security/2018/12/06/1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/ https://usn.ubuntu.com/3923-1/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.