CVE-2016-9845

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/12/05/15Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/22Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94763Third Party Advisory, VDB Entry
https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg00019.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/15Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/22Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94763Third Party Advisory, VDB Entry
https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg00019.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-49Third Party Advisory

Timeline

Published: Dec 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016