CVE-2016-6888

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=47882fa4975bf0b58dd74474329fdd7154e8f04c
http://www.openwall.com/lists/oss-security/2016/08/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/19/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92556Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03176.htmlPatch, Third Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=47882fa4975bf0b58dd74474329fdd7154e8f04c
http://www.openwall.com/lists/oss-security/2016/08/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/19/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92556Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03176.htmlPatch, Third Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory

Timeline

Published: Dec 10, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-68909.8Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an CVE-2016-68917.5MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in CVE-2016-68927.5The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) CVE-2016-68938.8Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijac CVE-2016-68947.5Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a de CVE-2016-68967.1Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo CVE-2016-68976.5Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef CVE-2016-68986.6XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SP CVE-2016-68997.5The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers CVE-2016-69005.5The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers CVE-2016-69016.5Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with soft CVE-2016-69029.9lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.