CVE-2019-12155

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 24, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-121565.3Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity verCVE-2019-121579.8In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.CVE-2019-121589.8GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.CVE-2019-121597.5GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL.CVE-2019-12165.5An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerCVE-2019-121609.8GoHTTP through 2017-07-25 has a sendHeader use-after-free.CVE-2019-121618.8WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250CVE-2019-121627.8Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code exCVE-2019-121635.3GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersioCVE-2019-121649.8ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution.CVE-2019-121659.8MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (CVE-2019-121676.1httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.
CVE-2019-12155: High severity, CVSS 7.5 | Vulnix