The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7094-1 advisory.

    It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS. (CVE-2019-20382)

    It was discovered that QEMU incorrectly handled certain memory copy operations when loading ROM contents.
    If a user were tricked into running an untrusted kernel image, a remote attacker could possibly use this     issue to run arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-13765)

    Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-1983)

    It was discovered that the SLiRP networking implementation of the QEMU emulator did not properly manage     memory under certain circumstances. An attacker could use this to cause a heap-based buffer overflow or     other out- of-bounds access, which can lead to a denial of service (application crash) or potential     execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-7039)

    It was discovered that the SLiRP networking implementation of the QEMU emulator misuses snprintf return     values. An attacker could use this to cause a denial of service (application crash) or potentially execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-8608)

    It was discovered that QEMU SLiRP networking incorrectly handled certain udp packets. An attacker inside a     guest could possibly use this issue to leak sensitive information from the host. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3592, CVE-2021-3594)

    It was discovered that QEMU had a DMA reentrancy issue, leading to a use-after-free vulnerability. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04     LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3019)

    It was discovered that QEMU had a flaw in Virtio PCI Bindings, leading to a triggerable crash via     vhost_net_stop. An attacker inside a guest could possibly use this issue to cause a denial of service.
    This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-4693)

    It was discovered that QEMU incorrectly handled memory in virtio-sound, leading to a heap-based buffer     overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-7730)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has qemu packages installed that are affected by multiple vulnerabilities:

  - A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak. (CVE-2023-6693)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service. (CVE-2023-3255)

  - A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device     backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this     time window to trigger an assertion and cause a denial of service. (CVE-2023-3301)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683)

  - A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-     crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This     issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a     denial of service or allow arbitrary code execution within the context of the QEMU process on the host.
    (CVE-2024-3446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has qemu packages installed that are affected by multiple vulnerabilities:

  - A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak. (CVE-2023-6693)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683)

  - A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-     crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This     issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a     denial of service or allow arbitrary code execution within the context of the QEMU process on the host.
    (CVE-2024-3446)

  - A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-     snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data     buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to     virtio_snd_pcm_status, which makes the available space for audio data zero. (CVE-2024-7730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-     snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data     buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to     virtio_snd_pcm_status, which makes the available space for audio data zero. (CVE-2024-7730)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0500 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-4467:
    A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-     snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data     buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to     virtio_snd_pcm_status, which makes the available space for audio data zero.

    CVE-2024-7730:
    A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network     card, the indirections_table data within RSS becomes controllable. Setting excessively large values may     cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a     privileged user in the guest to crash the QEMU process on the host.

    CVE-2024-6505:
    A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file     containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host     to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing     external file.

    CVE-2024-3567:
    A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in     hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw     allows a malicious guest to crash QEMU and cause a denial of service condition.

    CVE-2024-7409:
    A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via     improper synchronization during socket closure when a client keeps a socket open as the server is taken     offline.

    CVE-2024-3446:
    A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-     crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This     issue could allow a malicious privileged guest to crash the QEMU process on the host, resulting in a     denial of service or allow arbitrary code execution within the context of the QEMU process on the host.

    CVE-2024-3447:
    A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when     both `s->data_count` and the size of  `s->fifo_buffer` are set to 0x200, leading to an out-of-bound     access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial     of service condition.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
210736	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : QEMU vulnerabilities (USN-7094-1)	Nessus	Ubuntu Local Security Checks	11/11/2024	9/3/2025	high
242719	NewStart CGSL MAIN 7.02 : qemu Multiple Vulnerabilities (NS-SA-2025-0153)	Nessus	NewStart CGSL Local Security Checks	7/25/2025	7/25/2025	medium
237987	NewStart CGSL MAIN 7.02 : qemu Multiple Vulnerabilities (NS-SA-2025-0072)	Nessus	NewStart CGSL Local Security Checks	6/9/2025	6/18/2025	medium
230693	Linux Distros Unpatched Vulnerability : CVE-2024-7730	Nessus	Misc.	3/6/2025	8/30/2025	high
238706	TencentOS Server 4: qemu (TSSA-2024:0500)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high

Detections

Analytics

Plugins Search

high

medium

medium

high

high