CVE-2016-7907

The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

• CWE-20
• CWE-399

• http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/03/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/03/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93274Third Party Advisory, VDB Entry
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.htmlMailing List, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/201611-11Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/03/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/03/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93274Third Party Advisory, VDB Entry
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.htmlMailing List, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/201611-11Third Party Advisory

Published

Oct 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7901Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-7902Unrestricted file upload vulnerability in the fileUnzip->unz…
• CVE-2016-7903Dotclear before 2.10.3, when the Host header is not part of …
• CVE-2016-7904Cross-site request forgery (CSRF) vulnerability in CMS Made …
• CVE-2016-7905The read_gab2_sub function in libavformat/avidec.c in FFmpeg…
• CVE-2016-7906magick/attribute.c in ImageMagick 7.0.3-2 allows remote atta…5.5
• CVE-2016-7908The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka …4.4
• CVE-2016-7909The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka …4.4
• CVE-2016-7910Use-after-free vulnerability in the disk_seqf_stop function …7.8
• CVE-2016-7911Race condition in the get_task_ioprio function in block/iopr…7.8
• CVE-2016-7912Use-after-free vulnerability in the ffs_user_copy_worker fun…7.8
• CVE-2016-7913The xc2028_set_config function in drivers/media/tuners/tuner…7.8