CVE-2015-8701

QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.

• CWE-193

• http://www.openwall.com/lists/oss-security/2015/12/28/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/29/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/79706Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1286971Issue Tracking
• https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201602-01Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/28/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/29/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/79706Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1286971Issue Tracking
• https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201602-01Third Party Advisory

Published

Dec 29, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8685Multiple cross-site scripting (XSS) vulnerabilities in Dolib…
• CVE-2015-8687Multiple cross-site scripting (XSS) vulnerabilities in the M…
• CVE-2015-8688Gajim before 0.16.5 allows remote attackers to modify the ro…
• CVE-2015-8697stalin 0.11-5 allows local users to write to arbitrary files…
• CVE-2015-8698CA Release Automation (formerly LISA Release Automation) 5.0…
• CVE-2015-8699Multiple cross-site scripting (XSS) vulnerabilities in CA Re…
• CVE-2015-8702The DNS::GetResult function in dns.cpp in InspIRCd before 2.…
• CVE-2015-8703ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE …
• CVE-2015-8704apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x …
• CVE-2015-8705buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when …
• CVE-2015-8707Password reset tokens in Magento CE before 1.9.2.2, and Mage…
• CVE-2015-8708Stack-based buffer overflow in the conv_euctojis function in…