Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu-kvmUpgrade qemu | Mar 31, 2017 | Sep 11, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Dec 4, 2019 | Dec 10, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Apr 16, 2020 | Dec 10, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 11, 2016 |
| Suse | — | Upgrade qemu-s390Upgrade qemu-microvmUpgrade qemu-block-rbdUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-appUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-block-sshUpgrade qemu-ppcUpgrade qemu-guest-agentUpgrade qemu-block-iscsiUpgrade qemu-ipxeUpgrade qemu-audio-spiceUpgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-ui-spice-coreUpgrade qemu-chardev-baumUpgrade qemu-s390xUpgrade qemu-ui-openglUpgrade qemu-audio-paUpgrade qemu-skibootUpgrade qemu-chardev-spiceUpgrade qemu-audio-alsaUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-vgabiosUpgrade qemu-x86Upgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-toolsUpgrade kvmUpgrade qemu-armUpgrade qemu-kvmUpgrade qemu-hw-display-qxlUpgrade qemu-ui-cursesUpgrade qemuUpgrade qemu-sgabios | Nov 3, 2016 | Oct 21, 2016 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-systemUpgrade qemu-kvmUpgrade qemu-system-arm | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub