CVE-2011-4111: Qemu

Medium severity, CVSS 6.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

Affected products

• Qemu Qemu: up to and including 0.15.1; version 0.15.0 only; version 1.0 only
• Red Hat Enterprise Linux: version 6.0 only
• Red Hat Enterprise Linux Server Supplementary: version 6.1.z only

Published 2014-02-26. Last modified 2026-06-16.