CVE-2015-6855

hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.

• CWE-369

• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlMailing List, Third Party Advisory
• http://www.debian.org/security/2015/dsa-3361Third Party Advisory
• http://www.debian.org/security/2015/dsa-3362Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/10/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/10/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/76691Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2745-1Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201602-01Third Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168602.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169327.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169341.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlMailing List, Third Party Advisory
• http://www.debian.org/security/2015/dsa-3361Third Party Advisory
• http://www.debian.org/security/2015/dsa-3362Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/10/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/10/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/76691Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2745-1Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg02479.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201602-01Third Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14Third Party Advisory

Published

Nov 6, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-6849EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x be…
• CVE-2015-6850EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patc…
• CVE-2015-6851EMC RSA SecurID Web Agent before 8.0 allows physically proxi…
• CVE-2015-6852Directory traversal vulnerability in the API in EMC Secure R…
• CVE-2015-6853The Domino web agent in CA Single Sign-On (aka SSO, formerly…
• CVE-2015-6854The non-Domino web agents in CA Single Sign-On (aka SSO, for…
• CVE-2015-6856Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 all…
• CVE-2015-6857Unspecified vulnerability in Virtual Table Server (VTS) in H…
• CVE-2015-6858HP Insight Control server provisioning before 7.5.0 RabbitMQ…
• CVE-2015-6859HPE Network Switches with software 15.16.x and 15.17.x allow…
• CVE-2015-6860HPE Network Switches with software 15.16.x and 15.17.x allow…
• CVE-2015-6861HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote auth…