CVE catalog

CVE-2018-16872

qemu: CVE-2018-16872

Severity: Medium · CVSS 5CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Published: Dec 13, 2018, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.07% · Oct 27, 2026

A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	qemu	sid	`1:11.1.2+ds-3`	fixed
Debian	qemu	forky	`1:11.1.2+ds-3`	fixed
Debian	qemu	trixie	`1:10.0.13+ds-0+deb13u1`	fixed
Debian	qemu	trixie-security	`1:10.0.2+ds-2+deb13u1`	fixed
Debian	qemu	bookworm	`1:7.2+dfsg-7+deb12u18`	fixed
Debian	qemu	bookworm-security	`1:7.2+dfsg-7+deb12u15`	fixed
Ubuntu	qemu	14.04	`1.5.0+dfsg-3ubuntu5`	vulnerable
Ubuntu	qemu	14.04	`1.5.0+dfsg-3ubuntu6`	vulnerable
Ubuntu	qemu	14.04	`1.6.0+dfsg-2ubuntu1`	vulnerable
Ubuntu	qemu	14.04	`1.6.0+dfsg-2ubuntu2`	vulnerable
Ubuntu	qemu	14.04	`1.6.0+dfsg-2ubuntu3`	vulnerable
Ubuntu	qemu	14.04	`1.6.0+dfsg-2ubuntu4`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu1`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu2`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu3`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu4`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu5`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu7`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu8`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-2ubuntu9`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu1~ppa1`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu1`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu2`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu3`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu4`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu5`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu6`	vulnerable
Ubuntu	qemu	14.04	`1.7.0+dfsg-3ubuntu7`	vulnerable
Ubuntu	qemu	14.04	`2.0.0~rc1+dfsg-0ubuntu1`	vulnerable
Ubuntu	qemu	14.04	`2.0.0~rc1+dfsg-0ubuntu2`	vulnerable
Ubuntu	qemu	14.04	`2.0.0~rc1+dfsg-0ubuntu3`	vulnerable
Ubuntu	qemu	14.04	`2.0.0~rc1+dfsg-0ubuntu3.1`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.1`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.2`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.3`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.5`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.6`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.7`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.8`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.9`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.10`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.11`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.13`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.14`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.15`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.16`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.17`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.18`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.19`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.20`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.21`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.22`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.24`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.25`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.26`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.27`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.28`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.29`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.30`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.31`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.32`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.33`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.34`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.35`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.36`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.38`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.39`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.40`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.41`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.42`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.43`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.44`	vulnerable
Ubuntu	qemu	14.04	`2.0.0+dfsg-2ubuntu1.45`	fixed
Ubuntu	qemu	16.04	`1:2.3+dfsg-5ubuntu9`	vulnerable
Ubuntu	qemu	16.04	`1:2.3+dfsg-5ubuntu10`	vulnerable
Ubuntu	qemu	16.04	`1:2.4+dfsg-4ubuntu1`	vulnerable
Ubuntu	qemu	16.04	`1:2.4+dfsg-4ubuntu2`	vulnerable
Ubuntu	qemu	16.04	`1:2.4+dfsg-4ubuntu3`	vulnerable
Ubuntu	qemu	16.04	`1:2.4+dfsg-5ubuntu3`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-1ubuntu2`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-1ubuntu3`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-1ubuntu4`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-1ubuntu5`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu1`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu2`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu4`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu6`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu7`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.1`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.2`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.3`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.4`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.5`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.6`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.7`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.8`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.9`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.10`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.11`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.13`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.14`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.15`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.16`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.20`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.21`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.22`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.24`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.25`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.26`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.28`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.29`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.30`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.31`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.32`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.33`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.34`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.35`	vulnerable
Ubuntu	qemu	16.04	`1:2.5+dfsg-5ubuntu10.36`	fixed
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu3`	vulnerable
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu4`	vulnerable
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu1`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu2`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu4`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu6`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.1`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.2`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.3`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.4`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.6`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.7`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.8`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.9`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.10`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.12`	fixed
Suse	qemu	linux enterprise server 12 sp1-ltss	`2.3.1-33.20.1`	fixed
Suse	qemu	linux enterprise module for basesystem 15	`2.11.2-9.20.1`	fixed
Suse	qemu	linux enterprise module for server applications 15	`2.11.2-9.20.1`	fixed
Suse	qemu	linux enterprise server for sap applications 12 sp1	`2.3.1-33.20.1`	fixed
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu3`	vulnerable
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu4`	vulnerable
Ubuntu	qemu	18.04	`1:2.10+dfsg-0ubuntu5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu1`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu2`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu4`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu6`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.1`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.2`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.3`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.4`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.5`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.6`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.7`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.8`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.9`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.10`	vulnerable
Ubuntu	qemu	18.04	`1:2.11+dfsg-1ubuntu7.12`	fixed
Suse	qemu	linux enterprise desktop 12 sp4	`2.11.2-5.8.1`	fixed
Suse	qemu	linux enterprise server 12 sp4	`2.11.2-5.8.1`	fixed
Suse	qemu	linux enterprise server for sap applications 12 sp4	`2.11.2-5.8.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	qemu	source	sid	`1:3.1+dfsg-2`	not yet assigned	Not reported	[916397]
Debian	qemu	source	forky	`1:3.1+dfsg-2`	not yet assigned	Not reported	[916397]
Debian	qemu	source	trixie	`1:3.1+dfsg-2`	not yet assigned	Not reported	[916397]
Debian	qemu	source	bookworm	`1:3.1+dfsg-2`	not yet assigned	Not reported	[916397]
Ubuntu	qemu	deb	14.04	`2.0.0+dfsg-2ubuntu1.45`	Not reported	USN-3923-1	Not reported
Ubuntu	qemu	deb	16.04	`1:2.5+dfsg-5ubuntu10.36`	Not reported	USN-3923-1	Not reported
Ubuntu	qemu	deb	18.04	`1:2.11+dfsg-1ubuntu7.12`	Not reported	USN-3923-1	Not reported
Suse	qemu	rpm	linux enterprise server 12 sp1-ltss	`2.3.1-33.20.1`	Not reported	SUSE-SU-2019:0471-1	Not reported
Suse	qemu	rpm	linux enterprise module for basesystem 15	`2.11.2-9.20.1`	Not reported	SUSE-SU-2019:0423-1	Not reported
Suse	qemu	rpm	linux enterprise module for server applications 15	`2.11.2-9.20.1`	Not reported	SUSE-SU-2019:0423-1	Not reported
Suse	qemu	rpm	linux enterprise server for sap applications 12 sp1	`2.3.1-33.20.1`	Not reported	SUSE-SU-2019:0471-2	Not reported
Ubuntu	qemu	deb	18.04	`1:2.11+dfsg-1ubuntu7.12`	Not reported	UBUNTU-CVE-2018-16872	Not reported
Suse	qemu	rpm	linux enterprise desktop 12 sp4	`2.11.2-5.8.1`	Not reported	SUSE-SU-2019:0435-1	Not reported
Suse	qemu	rpm	linux enterprise server 12 sp4	`2.11.2-5.8.1`	Not reported	SUSE-SU-2019:0435-1	Not reported
Suse	qemu	rpm	linux enterprise server for sap applications 12 sp4	`2.11.2-5.8.1`	Not reported	SUSE-SU-2019:0435-1	Not reported

[Debian bug #916397]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[qemu-block-extra]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-guest-agent]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-arm]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-common]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-data]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18 · all · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18 · all · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · all · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · all · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-gui]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-mips]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-misc]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-modules-opengl]Unknown
Source package: [qemu]
Details (2)
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-modules-spice]Unknown
Source package: [qemu]
Details (2)
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-ppc]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-riscv]Unknown
Source package: [qemu]
Details (2)
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-s390x]Unknown
Source package: [qemu]
Details (2)
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-sparc]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-x86]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-system-xen]Unknown
Source package: [qemu]
Details (3)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-user]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-user-binfmt]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
[qemu-user-static]Unknown
Source package: [qemu]
Details (6)
- 1:7.2+dfsg-7+deb12u18+b3 · amd64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u18+b3 · arm64 · bookworm
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:10.0.2+ds-2+deb13u1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · amd64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12
- 1:7.2+dfsg-7+deb12u15 · arm64 · bookworm-security
  Fixed · Fixed: 1:3.1+dfsg-2
  dsa · qemu · debian · bookworm; dsa · qemu · debian · 12

Next results

Observed: Oct 23, 2026, 5:35:13 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]