USN-8412-1

Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations, leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2020-14394)

Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-15469)

Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-17380)

Sergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the USB xHCI controller implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25624)

It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures, leading to a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25723)

Gaoning Pan discovered that the network device emulation in QEMU could be made to trigger an assertion failure when processing packets that lacked a valid layer 3 protocol. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-27617)

Wenxiang Qian discovered that the ATAPI emulation in QEMU did not properly validate a buffer index, leading to an out-of-bounds read. An attacker inside the guest could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-29443)

Cheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)

Cheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35505)

It was discovered that the SDHCI controller emulation in QEMU contained out-of-bounds read and write issues. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3409)

It was discovered that several network device emulations in QEMU contained an infinite loop when operating in loopback mode. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3416)

Alexander Bulekov discovered that the floppy disk emulation in QEMU contained a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3507)

Remy Noel discovered that the USB redirector device emulation in QEMU performed an unbounded stack allocation when combining USB packets. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3527)

It was discovered that the QXL display device emulation in QEMU contained an integer overflow, leading to a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)

It was discovered that the QXL display device emulation in QEMU performed a double fetch of guest-controlled values, leading to a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4207)

It was discovered that the 9pfs server implementation in QEMU contained a race condition, leading to a use-after-free. A malicious 9p client could possibly use this issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-20181)

Gaoning Pan discovered that the floppy disk emulation in QEMU contained a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)

Gaoning Pan discovered that the vmxnet3 network device emulation in QEMU contained an integer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20203)

It was discovered that the ARM Generic Interrupt Controller emulation in QEMU contained an out-of-bounds heap access. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20221)

Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the e1000 network device emulation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20257)

It was discovered that the 9p passthrough file system implementation in QEMU did not prevent opening special files on the host. A malicious guest could possibly use this issue to escape the exported 9p tree. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-2861)

It was discovered that the virtio crypto device emulation in QEMU did not properly validate certain buffer lengths, leading to a heap buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3180)

It was discovered that the built-in VNC server in QEMU contained a NULL pointer dereference when cleaning up a connection that failed during the handshake. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-3354)

It was discovered that QEMU could incorrectly direct a guest I/O operation to disk offset 0 instead of the intended offset. An attacker inside the guest could possibly use this issue to read or overwrite sensitive data, potentially gaining control of the host. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)

It was discovered that several virtio device emulations in QEMU did not properly guard against DMA reentrancy, leading to a double free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-3446)

It was discovered that the SDHCI device emulation in QEMU contained a heap- based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-3447)

It was discovered that the QEMU disk image utility (qemu-img) did not properly handle certain crafted image files. An attacker could possibly use this issue to cause qemu-img to consume excessive resources or access an unintended external file, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2024-4467)

Cyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter emulation in QEMU contained a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519)

It was discovered that the NBD server in QEMU contained an improper synchronization issue during socket closure. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-7409)

It was discovered that the USB emulation in QEMU contained a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled resources during the VNC WebSocket handshake, leading to a use-after-free. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-11234)

It was discovered that QEMU could be made to read out of bounds when reading VMDK images. An attacker could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a denial of service. (CVE-2026-2243)

References

Affected packages

Ubuntu:Pro:14.04:LTS / qemu

Package

Name: qemu
Purl: pkg:deb/ubuntu/qemu?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.0+dfsg-2ubuntu1.47+esm6

Affected versions

1.*

1.5.0+dfsg-3ubuntu5

1.5.0+dfsg-3ubuntu6

1.6.0+dfsg-2ubuntu1

1.6.0+dfsg-2ubuntu2

1.6.0+dfsg-2ubuntu3

1.6.0+dfsg-2ubuntu4

1.7.0+dfsg-2ubuntu1

1.7.0+dfsg-2ubuntu2

1.7.0+dfsg-2ubuntu3

1.7.0+dfsg-2ubuntu4

1.7.0+dfsg-2ubuntu5

1.7.0+dfsg-2ubuntu7

1.7.0+dfsg-2ubuntu8

1.7.0+dfsg-2ubuntu9

1.7.0+dfsg-3ubuntu1~ppa1

1.7.0+dfsg-3ubuntu1

1.7.0+dfsg-3ubuntu2

1.7.0+dfsg-3ubuntu3

1.7.0+dfsg-3ubuntu4

1.7.0+dfsg-3ubuntu5

1.7.0+dfsg-3ubuntu6

1.7.0+dfsg-3ubuntu7

2.*

2.0.0~rc1+dfsg-0ubuntu1

2.0.0~rc1+dfsg-0ubuntu2

2.0.0~rc1+dfsg-0ubuntu3

2.0.0~rc1+dfsg-0ubuntu3.1

2.0.0+dfsg-2ubuntu1

2.0.0+dfsg-2ubuntu1.1

2.0.0+dfsg-2ubuntu1.2

2.0.0+dfsg-2ubuntu1.3

2.0.0+dfsg-2ubuntu1.5

2.0.0+dfsg-2ubuntu1.6

2.0.0+dfsg-2ubuntu1.7

2.0.0+dfsg-2ubuntu1.8

2.0.0+dfsg-2ubuntu1.9

2.0.0+dfsg-2ubuntu1.10

2.0.0+dfsg-2ubuntu1.11

2.0.0+dfsg-2ubuntu1.13

2.0.0+dfsg-2ubuntu1.14

2.0.0+dfsg-2ubuntu1.15

2.0.0+dfsg-2ubuntu1.16

2.0.0+dfsg-2ubuntu1.17

2.0.0+dfsg-2ubuntu1.18

2.0.0+dfsg-2ubuntu1.19

2.0.0+dfsg-2ubuntu1.20

2.0.0+dfsg-2ubuntu1.21

2.0.0+dfsg-2ubuntu1.22

2.0.0+dfsg-2ubuntu1.24

2.0.0+dfsg-2ubuntu1.25

2.0.0+dfsg-2ubuntu1.26

2.0.0+dfsg-2ubuntu1.27

2.0.0+dfsg-2ubuntu1.28

2.0.0+dfsg-2ubuntu1.29

2.0.0+dfsg-2ubuntu1.30

2.0.0+dfsg-2ubuntu1.31

2.0.0+dfsg-2ubuntu1.32

2.0.0+dfsg-2ubuntu1.33

2.0.0+dfsg-2ubuntu1.34

2.0.0+dfsg-2ubuntu1.35

2.0.0+dfsg-2ubuntu1.36

2.0.0+dfsg-2ubuntu1.38

2.0.0+dfsg-2ubuntu1.39

2.0.0+dfsg-2ubuntu1.40

2.0.0+dfsg-2ubuntu1.41

2.0.0+dfsg-2ubuntu1.42

2.0.0+dfsg-2ubuntu1.43

2.0.0+dfsg-2ubuntu1.44

2.0.0+dfsg-2ubuntu1.45

2.0.0+dfsg-2ubuntu1.46

2.0.0+dfsg-2ubuntu1.47

2.0.0+dfsg-2ubuntu1.47+esm1

2.0.0+dfsg-2ubuntu1.47+esm2

2.0.0+dfsg-2ubuntu1.47+esm3

2.0.0+dfsg-2ubuntu1.47+esm4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "qemu",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-guest-agent",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-keymaps",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-kvm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-arm",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-common",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-mips",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-misc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-ppc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-sparc",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-system-x86",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-user",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-user-static",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        },
        {
            "binary_name": "qemu-utils",
            "binary_version": "2.0.0+dfsg-2ubuntu1.47+esm6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8412-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-1711"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-11947"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-12829"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-14394"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-15469"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-15859"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-15863"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-17380"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-25084"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-25624"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-25625"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-25723"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-27617"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-29443"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-35504"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-35505"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3416"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3507"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3527"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-4206"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-4207"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20181"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20196"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20203"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20221"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20257"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-2861"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-5088"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3446"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3447"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-6519"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-7409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-8354"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-2243"
        }
    ],
    "ecosystem": "Ubuntu:Pro:14.04:LTS"
}

Ubuntu:Pro:16.04:LTS / qemu

Package

Name: qemu
Purl: pkg:deb/ubuntu/qemu?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:2.5+dfsg-5ubuntu10.51+esm4

Affected versions

1:2.*

1:2.3+dfsg-5ubuntu9

1:2.3+dfsg-5ubuntu10

1:2.4+dfsg-4ubuntu1

1:2.4+dfsg-4ubuntu2

1:2.4+dfsg-4ubuntu3

1:2.4+dfsg-5ubuntu3

1:2.5+dfsg-1ubuntu2

1:2.5+dfsg-1ubuntu3

1:2.5+dfsg-1ubuntu4

1:2.5+dfsg-1ubuntu5

1:2.5+dfsg-5ubuntu1

1:2.5+dfsg-5ubuntu2

1:2.5+dfsg-5ubuntu4

1:2.5+dfsg-5ubuntu6

1:2.5+dfsg-5ubuntu7

1:2.5+dfsg-5ubuntu10

1:2.5+dfsg-5ubuntu10.1

1:2.5+dfsg-5ubuntu10.2

1:2.5+dfsg-5ubuntu10.3

1:2.5+dfsg-5ubuntu10.4

1:2.5+dfsg-5ubuntu10.5

1:2.5+dfsg-5ubuntu10.6

1:2.5+dfsg-5ubuntu10.7

1:2.5+dfsg-5ubuntu10.8

1:2.5+dfsg-5ubuntu10.9

1:2.5+dfsg-5ubuntu10.10

1:2.5+dfsg-5ubuntu10.11

1:2.5+dfsg-5ubuntu10.13

1:2.5+dfsg-5ubuntu10.14

1:2.5+dfsg-5ubuntu10.15

1:2.5+dfsg-5ubuntu10.16

1:2.5+dfsg-5ubuntu10.20

1:2.5+dfsg-5ubuntu10.21

1:2.5+dfsg-5ubuntu10.22

1:2.5+dfsg-5ubuntu10.24

1:2.5+dfsg-5ubuntu10.25

1:2.5+dfsg-5ubuntu10.26

1:2.5+dfsg-5ubuntu10.28

1:2.5+dfsg-5ubuntu10.29

1:2.5+dfsg-5ubuntu10.30

1:2.5+dfsg-5ubuntu10.31

1:2.5+dfsg-5ubuntu10.32

1:2.5+dfsg-5ubuntu10.33

1:2.5+dfsg-5ubuntu10.34

1:2.5+dfsg-5ubuntu10.35

1:2.5+dfsg-5ubuntu10.36

1:2.5+dfsg-5ubuntu10.37

1:2.5+dfsg-5ubuntu10.38

1:2.5+dfsg-5ubuntu10.39

1:2.5+dfsg-5ubuntu10.40

1:2.5+dfsg-5ubuntu10.41

1:2.5+dfsg-5ubuntu10.42

1:2.5+dfsg-5ubuntu10.43

1:2.5+dfsg-5ubuntu10.44

1:2.5+dfsg-5ubuntu10.45

1:2.5+dfsg-5ubuntu10.46

1:2.5+dfsg-5ubuntu10.47

1:2.5+dfsg-5ubuntu10.48

1:2.5+dfsg-5ubuntu10.49

1:2.5+dfsg-5ubuntu10.51

1:2.5+dfsg-5ubuntu10.51+esm1

1:2.5+dfsg-5ubuntu10.51+esm2

1:2.5+dfsg-5ubuntu10.51+esm3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "qemu",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-aarch64",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-user",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        },
        {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.5+dfsg-5ubuntu10.51+esm4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8412-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-14394"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-15469"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-35504"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-35505"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3416"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3507"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-3527"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-4206"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-4207"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20196"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20203"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20221"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2021-20257"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-2861"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-5088"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3446"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3447"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-6519"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-7409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-8354"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-2243"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}

Ubuntu:Pro:18.04:LTS / qemu

Package

Name: qemu
Purl: pkg:deb/ubuntu/qemu?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:2.11+dfsg-1ubuntu7.42+esm5

Affected versions

1:2.*

1:2.10+dfsg-0ubuntu3

1:2.10+dfsg-0ubuntu4

1:2.10+dfsg-0ubuntu5

1:2.11+dfsg-1ubuntu1

1:2.11+dfsg-1ubuntu2

1:2.11+dfsg-1ubuntu4

1:2.11+dfsg-1ubuntu5

1:2.11+dfsg-1ubuntu6

1:2.11+dfsg-1ubuntu7

1:2.11+dfsg-1ubuntu7.1

1:2.11+dfsg-1ubuntu7.2

1:2.11+dfsg-1ubuntu7.3

1:2.11+dfsg-1ubuntu7.4

1:2.11+dfsg-1ubuntu7.5

1:2.11+dfsg-1ubuntu7.6

1:2.11+dfsg-1ubuntu7.7

1:2.11+dfsg-1ubuntu7.8

1:2.11+dfsg-1ubuntu7.9

1:2.11+dfsg-1ubuntu7.10

1:2.11+dfsg-1ubuntu7.12

1:2.11+dfsg-1ubuntu7.13

1:2.11+dfsg-1ubuntu7.14

1:2.11+dfsg-1ubuntu7.15

1:2.11+dfsg-1ubuntu7.17

1:2.11+dfsg-1ubuntu7.18

1:2.11+dfsg-1ubuntu7.19

1:2.11+dfsg-1ubuntu7.20

1:2.11+dfsg-1ubuntu7.21

1:2.11+dfsg-1ubuntu7.22

1:2.11+dfsg-1ubuntu7.23

1:2.11+dfsg-1ubuntu7.25

1:2.11+dfsg-1ubuntu7.26

1:2.11+dfsg-1ubuntu7.27

1:2.11+dfsg-1ubuntu7.28

1:2.11+dfsg-1ubuntu7.29

1:2.11+dfsg-1ubuntu7.31

1:2.11+dfsg-1ubuntu7.32

1:2.11+dfsg-1ubuntu7.33

1:2.11+dfsg-1ubuntu7.34

1:2.11+dfsg-1ubuntu7.35

1:2.11+dfsg-1ubuntu7.36

1:2.11+dfsg-1ubuntu7.37

1:2.11+dfsg-1ubuntu7.38

1:2.11+dfsg-1ubuntu7.39

1:2.11+dfsg-1ubuntu7.40

1:2.11+dfsg-1ubuntu7.41

1:2.11+dfsg-1ubuntu7.42

1:2.11+dfsg-1ubuntu7.42+esm1

1:2.11+dfsg-1ubuntu7.42+esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "qemu",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-kvm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-common",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-user",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-user-static",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        },
        {
            "binary_name": "qemu-utils",
            "binary_version": "1:2.11+dfsg-1ubuntu7.42+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8412-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2020-14394"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-2861"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-3180"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-3354"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2023-5088"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3446"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3447"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-6519"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-7409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-8354"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2025-11234"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-2243"
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}

Ubuntu:Pro:20.04:LTS / qemu

Package

Name: qemu
Purl: pkg:deb/ubuntu/qemu?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.2-3ubuntu6.30+esm1

Affected versions

1:4.*

1:4.0+dfsg-0ubuntu9

1:4.0+dfsg-0ubuntu10

1:4.2-1ubuntu1

1:4.2-1ubuntu2

1:4.2-3ubuntu1

1:4.2-3ubuntu2

1:4.2-3ubuntu3

1:4.2-3ubuntu4

1:4.2-3ubuntu5

1:4.2-3ubuntu6

1:4.2-3ubuntu6.1

1:4.2-3ubuntu6.2

1:4.2-3ubuntu6.3

1:4.2-3ubuntu6.4

1:4.2-3ubuntu6.5

1:4.2-3ubuntu6.6

1:4.2-3ubuntu6.7

1:4.2-3ubuntu6.8

1:4.2-3ubuntu6.9

1:4.2-3ubuntu6.10

1:4.2-3ubuntu6.11

1:4.2-3ubuntu6.12

1:4.2-3ubuntu6.14

1:4.2-3ubuntu6.15

1:4.2-3ubuntu6.16

1:4.2-3ubuntu6.17

1:4.2-3ubuntu6.18

1:4.2-3ubuntu6.19

1:4.2-3ubuntu6.21

1:4.2-3ubuntu6.23

1:4.2-3ubuntu6.24

1:4.2-3ubuntu6.25

1:4.2-3ubuntu6.26

1:4.2-3ubuntu6.27

1:4.2-3ubuntu6.28

1:4.2-3ubuntu6.29

1:4.2-3ubuntu6.30

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "qemu",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-kvm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-common",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-data",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-user",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-user-static",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        },
        {
            "binary_name": "qemu-utils",
            "binary_version": "1:4.2-3ubuntu6.30+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8412-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3446"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-3447"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-4467"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-6519"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-7409"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2024-8354"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2025-11234"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-2243"
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}