The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8818
