CVE-2016-10028

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
http://www.openwall.com/lists/oss-security/2016/12/20/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/22/14Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94981Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037525Third Party Advisory, VDB Entry
https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31
http://www.openwall.com/lists/oss-security/2016/12/20/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/22/14Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94981Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037525Third Party Advisory, VDB Entry
https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory

Timeline

Published: Feb 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-100295.5The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users t CVE-2016-100308.1The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability i CVE-2016-100317.5WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This CVE-2016-100339.8The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c CVE-2016-100349.8The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framew CVE-2016-100369.8Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit CVE-2016-100377.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100387.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100397.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100405.5Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a x CVE-2016-100417.5An issue was discovered in Sprecher Automation SPRECON-E Service Program before 3.43 SP0. Under certain preconditions, it is possible to exe CVE-2016-100427.5Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized recon