CVE-2014-5388

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-193

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16
http://seclists.org/oss-sec/2014/q3/438Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2014/q3/440Mailing List, Third Party Advisory
http://www.ubuntu.com/usn/USN-2409-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1132956Issue Tracking, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.htmlPatch, Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16
http://seclists.org/oss-sec/2014/q3/438Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2014/q3/440Mailing List, Third Party Advisory
http://www.ubuntu.com/usn/USN-2409-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1132956Issue Tracking, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.htmlPatch, Third Party Advisory

Timeline

Published: Nov 15, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-53897.5SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to CVE-2014-53914.3Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.CVE-2014-53925.8XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of CVE-2014-53934.0Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 CVE-2014-53945.9Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.CVE-2014-53956.8Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI bef CVE-2014-53967.5The web interface in Schrack Technik microControl with firmware before 1.7.0 (937) has a hardcoded password of not for the "user" account, w CVE-2014-53974.3Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote CVE-2014-53982.1Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a CVE-2014-53997.5SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to CVE-2014-54002.1The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obt CVE-2014-54019.8Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow