CVE-2016-4439
- State
- Published
- Severity
- Not scored
- Published
- May 20, 2016
- Updated
- Aug 6, 2024
- Reserved
- May 2, 2016
Description
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- USN-3047-1vendor-advisory
- 90760vdb-entry
- GLSA-201609-01vendor-advisory
- USN-3047-2vendor-advisory
- [qemu-devel] 20160519 [PATCH 1/2] scsi: check command buffer length before write(CVE-2016-4439)mailing-list
- [oss-security] 20160519 CVE-2016-4439 Qemu: scsi: esp: OOB write while writing to 's->cmdbuf' in esp_reg_writemailing-list
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security updatemailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1337502
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.