CVE-2016-2391

The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.

• CWE-476

• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360
• http://www.openwall.com/lists/oss-security/2016/02/16/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/83263Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1304794Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.htmlPatch, Third Party Advisory
• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360
• http://www.openwall.com/lists/oss-security/2016/02/16/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/83263Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1304794Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.htmlPatch, Third Party Advisory

Published

Jun 16, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2385Heap-based buffer overflow in the encode_msg function in enc…
• CVE-2016-2386SQL injection vulnerability in the UDDI server in SAP NetWea…9.8
• CVE-2016-2387Multiple cross-site scripting (XSS) vulnerabilities in the J…
• CVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAV…5.3
• CVE-2016-2389Directory traversal vulnerability in the GetFileList functio…
• CVE-2016-2390The FwdState::connectedToPeer method in FwdState.cc in Squid…
• CVE-2016-2392The is_rndis function in the USB Net device emulator (hw/usb…
• CVE-2016-2393Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerpr…
• CVE-2016-2396The GMS ViewPoint (GMSVP) web application in Dell SonicWALL …
• CVE-2016-2397The cliserver implementation in Dell SonicWALL GMS, Analyzer…
• CVE-2016-2398Comcast XFINITY Home Security System does not properly maint…
• CVE-2016-2399Integer overflow in the quicktime_read_pascal function in li…