CVE-2016-9776

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/12/02/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/02/8Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94638Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1400829Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlThird Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/02/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/02/8Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94638Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1400829Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlThird Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory

Timeline

Published: Dec 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-97777.8KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to g CVE-2016-97785.9An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for CVE-2016-97937.8The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, whi CVE-2016-97947.8Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows lo CVE-2016-97957.8The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Perf CVE-2016-97969.8Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30 CVE-2016-97975.3In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered b CVE-2016-97985.3In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by CVE-2016-97995.3In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by process CVE-2016-98005.3In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists becaus CVE-2016-98015.3In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dum CVE-2016-98025.3In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered b