GCVE - cpe:2.3:a:qemu:qemu:6.1.0:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qemu:qemu:6.1.0:rc1:*:*:*:*:*:*

part: a version: 6.1.0 update: rc1

Vendor	Qemu (`dc79796f-803a-5e2c-8ac2-933a08531b40`)
Product	Qemu (`741928e6-f439-57f2-bcb7-48ccc5351068`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/qemu/qemu`	purl2cpe	2026-06-01 10:18:03.922420
`pkg:gitlab/qemu-project/qemu`	purl2cpe	2026-06-01 10:18:03.922421

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-4145`	vulnerable	2026-06-08 05:38:08.513257	Details available A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node. Published: 2022-01-25T19:11:14.000Z Updated: 2024-08-03T17:16:04.234Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=2034602 https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd https://security.netapp.com/advisory/ntap-20220311-0004/ https://security.gentoo.org/glsa/202208-27	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-3682`	vulnerable	2026-06-08 05:33:53.409459	Details available A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host. Published: 2021-08-05T19:51:26.000Z Updated: 2024-08-03T17:01:07.707Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1989651 https://security.netapp.com/advisory/ntap-20210902-0006/ https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html https://www.debian.org/security/2021/dsa-4980 https://security.gentoo.org/glsa/202208-27	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.