CVE-2016-2858

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956
http://www.openwall.com/lists/oss-security/2016/03/04/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/07/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/84134Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1314676Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201604-01Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956
http://www.openwall.com/lists/oss-security/2016/03/04/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/07/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/84134Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1314676Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201604-01Third Party Advisory

Timeline

Published: Apr 7, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-28606.5The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypas CVE-2016-28613.7IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt CVE-2016-28626.1Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative iFix 3, and 8.0 befor CVE-2016-28638.0Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.CVE-2016-28645.4Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5 CVE-2016-28656.5The GIT Integration component in IBM Rational Team Concert (RTC) 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 and Rational Collaborati CVE-2016-28664.3An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user.CVE-2016-28677.0IBM InfoSphere Streams before 4.0.1.2 and IBM Streams before 4.1.1.1 do not properly implement the runAsUser feature, which allows local use CVE-2016-28682.7IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an ex CVE-2016-28695.4Multiple cross-site scripting (XSS) vulnerabilities in the UI in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote a CVE-2016-28702.7Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of ser CVE-2016-28717.8IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to o