Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/154757?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/154757?format=api", "purl": "pkg:rpm/redhat/qemu-kvm-rhev@2:0.12.1.2-2.491.el6_8?arch=6", "type": "rpm", "namespace": "redhat", "name": "qemu-kvm-rhev", "version": "2:0.12.1.2-2.491.el6_8", "qualifiers": { "arch": "6" }, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99301?format=api", "vulnerability_id": "VCID-bk24-wqs5-5fcv", "summary": "Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-2615.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-2615.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-2615", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0101", "scoring_system": "epss", "scoring_elements": "0.77447", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0101", "scoring_system": "epss", "scoring_elements": "0.77474", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-2615" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2615", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2615" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv2", "scoring_elements": "AV:A/AC:M/Au:S/C:P/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200", "reference_id": "1418200", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1418200" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854731", "reference_id": "854731", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854731" }, { "reference_url": "https://security.gentoo.org/glsa/201702-27", "reference_id": "GLSA-201702-27", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201702-27" }, { "reference_url": "https://security.gentoo.org/glsa/201702-28", "reference_id": "GLSA-201702-28", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201702-28" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0309", "reference_id": "RHSA-2017:0309", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0309" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0328", "reference_id": "RHSA-2017:0328", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0328" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0329", "reference_id": "RHSA-2017:0329", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0329" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0330", "reference_id": "RHSA-2017:0330", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0330" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0331", "reference_id": "RHSA-2017:0331", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0331" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0332", "reference_id": "RHSA-2017:0332", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0332" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0333", "reference_id": "RHSA-2017:0333", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0333" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0334", "reference_id": "RHSA-2017:0334", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0334" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0344", "reference_id": "RHSA-2017:0344", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0344" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0350", "reference_id": "RHSA-2017:0350", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0350" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0396", "reference_id": "RHSA-2017:0396", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0396" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0454", "reference_id": "RHSA-2017:0454", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0454" }, { "reference_url": "https://usn.ubuntu.com/3261-1/", "reference_id": "USN-3261-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3261-1/" }, { "reference_url": "https://xenbits.xen.org/xsa/advisory-208.html", "reference_id": "XSA-208", "reference_type": "", "scores": [], "url": "https://xenbits.xen.org/xsa/advisory-208.html" } ], "fixed_packages": [], "aliases": [ "CVE-2017-2615", "XSA-208" ], "risk_score": 2.5, "exploitability": "0.5", "weighted_severity": "5.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bk24-wqs5-5fcv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99198?format=api", "vulnerability_id": "VCID-fys8-8bez-gfaj", "summary": "The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2857.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2857.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2857", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00058", "scoring_system": "epss", "scoring_elements": "0.18351", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00058", "scoring_system": "epss", "scoring_elements": "0.18428", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2857" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2857", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2857" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3", "scoring_system": "cvssv2", "scoring_elements": "AV:L/AC:M/Au:S/C:P/I:N/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567", "reference_id": "1296567", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1296567" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817182", "reference_id": "817182", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:2670", "reference_id": "RHSA-2016:2670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:2670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:2671", "reference_id": "RHSA-2016:2671", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:2671" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:2704", "reference_id": "RHSA-2016:2704", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:2704" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:2705", "reference_id": "RHSA-2016:2705", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:2705" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:2706", "reference_id": "RHSA-2016:2706", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:2706" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0083", "reference_id": "RHSA-2017:0083", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0083" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0309", "reference_id": "RHSA-2017:0309", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0309" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0334", "reference_id": "RHSA-2017:0334", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0334" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0344", "reference_id": "RHSA-2017:0344", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0344" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0350", "reference_id": "RHSA-2017:0350", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0350" }, { "reference_url": "https://usn.ubuntu.com/2974-1/", "reference_id": "USN-2974-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2974-1/" } ], "fixed_packages": [], "aliases": [ "CVE-2016-2857" ], "risk_score": 2.1, "exploitability": "0.5", "weighted_severity": "4.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fys8-8bez-gfaj" } ], "fixing_vulnerabilities": [], "risk_score": "2.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/qemu-kvm-rhev@2:0.12.1.2-2.491.el6_8%3Farch=6" }