GCVE - cpe:2.3:a:qemu:qemu:2.6.0:rc2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qemu:qemu:2.6.0:rc2:*:*:*:*:*:*

part: a version: 2.6.0 update: rc2

Vendor	Qemu (`dc79796f-803a-5e2c-8ac2-933a08531b40`)
Product	Qemu (`741928e6-f439-57f2-bcb7-48ccc5351068`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/qemu/qemu`	purl2cpe	2026-06-01 10:18:03.884961
`pkg:gitlab/qemu-project/qemu`	purl2cpe	2026-06-01 10:18:03.884963

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-4037`	vulnerable	2026-06-08 05:07:46.462964	Details available The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558. Published: 2016-05-23T19:00:00.000Z Updated: 2024-08-06T00:17:30.084Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2016/04/18/3 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1ae3f2f178087711f9591350abad133525ba93f2 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg02691.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3712`	vulnerable	2026-06-08 05:07:45.853257	Details available Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. Published: 2016-05-11T21:00:00.000Z Updated: 2024-08-06T00:03:34.421Z Open on db.gcve.eu Reference links http://xenbits.xen.org/xsa/advisory-179.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://rhn.redhat.com/errata/RHSA-2017-0621.html http://support.citrix.com/article/CTX212736 https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01196.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3710`	vulnerable	2026-06-08 05:07:45.845181	Details available The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue. Published: 2016-05-11T21:00:00.000Z Updated: 2024-08-06T00:03:34.465Z Open on db.gcve.eu Reference links http://xenbits.xen.org/xsa/advisory-179.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://rhn.redhat.com/errata/RHSA-2016-0999.html http://www.securityfocus.com/bid/90316 http://rhn.redhat.com/errata/RHSA-2016-0725.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2198`	vulnerable	2026-06-08 05:07:33.605998	Details available QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS. Published: 2016-12-29T22:00:00.000Z Updated: 2024-08-05T23:24:48.274Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2016/01/30/2 https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html https://bugzilla.redhat.com/show_bug.cgi?id=1301643 http://www.openwall.com/lists/oss-security/2016/01/29/6 https://security.gentoo.org/glsa/201604-01	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.