CVE-2016-10029

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7
http://www.openwall.com/lists/oss-security/2016/12/20/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/22/15Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94978Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037526Third Party Advisory, VDB Entry
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7
http://www.openwall.com/lists/oss-security/2016/12/20/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/22/15Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/94978Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037526Third Party Advisory, VDB Entry

Timeline

Published: Feb 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-100308.1The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability i CVE-2016-100317.5WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This CVE-2016-100339.8The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c CVE-2016-100349.8The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framew CVE-2016-100369.8Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit CVE-2016-100377.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100387.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100397.3Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/trav CVE-2016-100405.5Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a x CVE-2016-100417.5An issue was discovered in Sprecher Automation SPRECON-E Service Program before 3.43 SP0. Under certain preconditions, it is possible to exe CVE-2016-100427.5Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized recon CVE-2016-1004310.0An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulner