CVE-2016-7116

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=56f101ecce0eafd09e2daf1c4eeb1377d6959261
http://www.openwall.com/lists/oss-security/2016/08/30/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/30/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92680Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03917.htmlThird Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04231.htmlThird Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=56f101ecce0eafd09e2daf1c4eeb1377d6959261
http://www.openwall.com/lists/oss-security/2016/08/30/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/30/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92680Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03917.htmlThird Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04231.htmlThird Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory

Timeline

Published: Dec 10, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-71179.8Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to exec CVE-2016-71185.5fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 (kernel 3.2.81-1) in Debian wheezy mishandles F_SETFL f CVE-2016-71195.4Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated CVE-2016-71225.5The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that h CVE-2016-71238.8Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack th CVE-2016-71249.8ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers CVE-2016-71257.5ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which CVE-2016-71269.8The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colo CVE-2016-71279.8The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allo CVE-2016-71285.3The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offse CVE-2016-71299.8The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial o CVE-2016-71307.5The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of