CVE-2016-9776

QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.

• CWE-835

• http://www.openwall.com/lists/oss-security/2016/12/02/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/02/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94638Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1400829Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlThird Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201701-49Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/02/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/02/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94638Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1400829Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlThird Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.htmlPatch, Vendor Advisory
• https://security.gentoo.org/glsa/201701-49Third Party Advisory

Published

Dec 29, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9770Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9771Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9772OpenAFS 1.6.19 and earlier allows remote attackers to obtain…
• CVE-2016-9773Heap-based buffer overflow in the IsPixelGray function in Ma…
• CVE-2016-9774The postinst script in the tomcat6 package before 6.0.45+dfs…
• CVE-2016-9775The postrm script in the tomcat6 package before 6.0.45+dfsg-…
• CVE-2016-9777KVM in the Linux kernel before 4.8.12, when I/O APIC is enab…7.8
• CVE-2016-9778An error in handling certain queries can cause an assertion …7.5
• CVE-2016-9779Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9780Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9781Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9782Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…