CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.

• CWE-331

• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956
• http://www.openwall.com/lists/oss-security/2016/03/04/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/07/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/84134Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1314676Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201604-01Third Party Advisory
• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956
• http://www.openwall.com/lists/oss-security/2016/03/04/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/07/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/84134Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1314676Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201604-01Third Party Advisory

Published

Apr 7, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2851Integer overflow in proto.c in libotr before 4.1.1 on 64-bit…
• CVE-2016-2853The aufs module for the Linux kernel 3.x and 4.x does not pr…7.8
• CVE-2016-2854The aufs module for the Linux kernel 3.x and 4.x does not pr…7.8
• CVE-2016-2855The Huawei Mobile Broadband HL Service 22.001.25.00.03 and e…
• CVE-2016-2856pt_chown in the glibc package before 2.19-18+deb8u4 on Debia…
• CVE-2016-2857The net_checksum_calculate function in net/checksum.c in QEM…8.4
• CVE-2016-2859Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-2860The newEntry function in ptserver/ptprocs.c in OpenAFS befor…
• CVE-2016-2861IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 befo…
• CVE-2016-2862Cross-site scripting (XSS) vulnerability in IBM WebSphere Co…
• CVE-2016-2863Cross-site request forgery (CSRF) vulnerability in IBM WebSp…
• CVE-2016-2864Cross-site scripting (XSS) vulnerability in IBM Rational Col…