Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2014-0147

created 1 month, 3 weeks ago

Qemu before 1.6.2 block diver for the various disk image …

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.

References

http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_transferredx_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_transferredx_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_transferredx_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_transferredx_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c… x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1078848 x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1086717 x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0420.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0421.html x_transferredx_refsource_MISC
http://www.openwall.com/lists/oss-security/2014/03/26/8 x_transferredx_refsource_MISC

Affected products

Qemu

==before 1.6.2

Matching in nixpkgs

pkgs.qemu

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_kvm

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_full

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_test

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu-utils

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.canokey-qemu

CanoKey QEMU Virt Card

pkgs.ubootQemuX86

Boot loader for embedded systems

nixos-unstable x86_defconfig-2025.10
- nixpkgs-unstable x86_defconfig-2025.10
- nixos-unstable-small x86_defconfig-2025.10
nixos-25.11 x86_defconfig-2025.10
- nixos-25.11-small x86_defconfig-2025.10
- nixpkgs-25.11-darwin x86_defconfig-2025.10

pkgs.ubootQemuX86_64

Boot loader for embedded systems

nixos-unstable x86_64_defconfig-2025.10
- nixpkgs-unstable x86_64_defconfig-2025.10
- nixos-unstable-small x86_64_defconfig-2025.10
nixos-25.11 x86_64_defconfig-2025.10
- nixos-25.11-small x86_64_defconfig-2025.10
- nixpkgs-25.11-darwin x86_64_defconfig-2025.10

pkgs.ubootQemuAarch64

Boot loader for embedded systems

nixos-unstable qemu_arm64_defconfig-2025.10
- nixpkgs-unstable qemu_arm64_defconfig-2025.10
- nixos-unstable-small qemu_arm64_defconfig-2025.10
nixos-25.11 qemu_arm64_defconfig-2025.10
- nixos-25.11-small qemu_arm64_defconfig-2025.10
- nixpkgs-25.11-darwin qemu_arm64_defconfig-2025.10

pkgs.qemu-python-utils

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1
nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.armTrustedFirmwareQemu

Reference implementation of secure world software for ARMv8-A

nixos-unstable 2.13.0
- nixpkgs-unstable 2.13.0
- nixos-unstable-small 2.13.0
nixos-25.11 2.13.0
- nixos-25.11-small 2.13.0
- nixpkgs-25.11-darwin 2.13.0

pkgs.python312Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1
nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.python314Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1

pkgs.python312Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-25.11 0.0.5
- nixos-25.11-small 0.0.5
- nixpkgs-25.11-darwin 0.0.5

pkgs.python313Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-unstable 0.0.5
- nixpkgs-unstable 0.0.5
- nixos-unstable-small 0.0.5
nixos-25.11 0.0.5
- nixos-25.11-small 0.0.5
- nixpkgs-25.11-darwin 0.0.5

pkgs.python314Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-unstable 0.0.5
- nixpkgs-unstable 0.0.5
- nixos-unstable-small 0.0.5

Package maintainers

@lopsided98 Ben Wolsieffer <benwolsieffer@gmail.com>
@oxalica oxalica <oxalicc@pm.me>
@DavHau David Hauer <d.hauer.it@gmail.com>
@devplayer0 Jack O'Sullivan <dev@nul.ie>
@alyssais Alyssa Ross <hi@alyssa.is>
@SigmaSquadron Fernando Rodrigues <alpha@sigmasquadron.net>
@CertainLach Yaroslav Bolyukin <iam@lach.pw>
@digitalrane Rane <rane+git@junkyard.systems>
@hehongbo Hongbo
@bartsch Daniel Martin <consume.noise@gmail.com>
@dezgeg Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
@brianmcgillion Brian McGillion <bmg.avoin@gmail.com>