QEMU is a generic and open source machine & userspace emulator and virtualizer.
QEMU is subject to a buffer overflow vulnerability as described in CVE-2018-17962.
The vulnerability was fixed by commit b1d80d12c5f7ff081bb80ab4f4241d4248691192.
A description of the fix is here
Full Report
The projects listed below potentially contain the vulnerability and have been touched in 2020.

1. commit = 2804b36915bf59dfe57ff603f53adc8c6373df89
   head_commit = 0f6e543f25638bca1b6741aad8d95bb095cfc262 (2020-03-12:09:49:29)
   project = github.com/ssdemajia/qemu-2.10.0
   path = hw/net/pcnet.c
   
   
2. commit = 3a4c480cfdf4b6efecb8b1350ec960c32230da85
   head_commit = 52ed61022d406bbec680aec164123c47be8039c8 (2020-04-26:17:34:13)
   project = github.com/haoywei/hw55
   path = hw5/hw5/afl-2.52b/qemu_mode/qemu-2.10.0/hw/net/pcnet.c
   
   
3. commit = 613e390df815750b7de3ecc833fa0009f0bbab18
   head_commit = 613e390df815750b7de3ecc833fa0009f0bbab18 (2020-03-06:01:08:51)
   project = github.com/xiang-lab/op-tee
   path = qemu/hw/net/pcnet.c
   
   
4. commit = 721e929c32016fcdadaca53e48a72855f7666c61
   head_commit = 6853bd954ef55465d74afa959ee9775c8043ebd9 (2020-06-01:10:27:20)
   project = github.com/bvqbao/vtf-xen
   path = tools/qemu-xen/hw/net/pcnet.c
   
   
5. commit = 8554bd66879885032453252309871794975448dd
   head_commit = 2cc3a99c3e3bd4ff54a366142556913c41d3777d (2020-07-07:07:43:59)
   project = github.com/zyw-200/FirmAFL
   path = user_mode/hw/net/pcnet.c
   path = qemu_mode/DECAF_qemu_2.10/hw/net/pcnet.c
   
   
6. commit = a16f4bbe12ac31ee350e7ad208468c19bdaeb485
   head_commit = 01c113b61ab70c3b02f3d7c74e6dfa20cfc7813d (2020-07-26:21:06:32)
   project = github.com/CAFA1/afl
   path = qemu_mode/qemu-2.10.0/hw/net/pcnet.c
   
   
7. commit = ae8aaaae65899bd9f8b4f59a42203f1862279ae0
   head_commit = bb1fb021c4b33864c0c059d33cf7b7494817d496 (2020-03-06:15:02:56)
   project = github.com/lewiz-support/LMAC_CORE2
   path = Software_Driver/Co-Sim/qemu/hw/net/pcnet.c
   
   
8. commit = c5cab5ca3c7a4897918117785a6182f76dd43667
   head_commit = fc33bab801388a94e93149473e6d5c3a3aa3e95a (2020-08-14:14:34:15)
   project = github.com/strongcourage/uafuzz
   path = binsec/src/uafuzz/afl-2.52b/qemu_mode_aflgob/qemu-2.10.0/hw/net/pcnet.c
   path = binsec/src/uafuzz/afl-2.52b/qemu_mode_uafuzz/qemu-2.10.0/hw/net/pcnet.c
   
   
9. commit = fc8df34f2c225497300a52b61bca378761cd1fab
   head_commit = fc8df34f2c225497300a52b61bca378761cd1fab (2020-04-13:23:27:59)
   project = github.com/OneContainers/qemu
   path = hw/net/pcnet.c
   
   
10. commit = fcd01b221facb8dbb45c90ee3967593e0882cc92
    head_commit = fcd01b221facb8dbb45c90ee3967593e0882cc92 (2020-03-06:01:34:16)
    project = github.com/GiantVM/QEMU
    path = hw/net/pcnet.c
    
    
11. commit = 15fd13ecb121531649870a5ff1026486eb37db52
    head_commit = f7d910be1bba55be87c4ae716eca660c93216d24 (2020-03-01:07:22:01)
    project = github.com/hku-systems/plover
    path = qemu/hw/net/pcnet.c
    
    
12. commit = a79f5c1893f9e94256c48c8a29efd517237b4465
    head_commit = 737127a453d2d79f044176a39bce4563a2a5f134 (2020-04-26:17:51:30)
    project = github.com/cwfletcher/oisa
    path = Pre-NDSS/rocket-chip/riscv-tools/riscv-gnu-toolchain/riscv-qemu/hw/net/pcnet.c
    
    
13. commit = 6b9c2f98bd834e1df9bcc4d3a8fd95cfbe039cab
    head_commit = aa20ece6a6d4780b0944b61d9030348bc56c7e35 (2020-03-15:09:06:09)
    project = github.com/ray-cp/vm-escape
    path = qemu-escape/cve-2015-5165_and_cve-2015-7504/pcnet.c
    
    
14. commit = 4e212562c01f6c1b97f25b47ce6c20427f3ef295
    head_commit = e8e286aaf3184258ef0ac6c46a6a7aac1dc49d0f (2020-03-05:07:38:28)
    project = github.com/secyourdev/FreertosMultiUART
    path = qemu_stm32/hw/net/pcnet.c
    
    
15. commit = 87ca2bebd04a11e71d4778554b5b9d95d2e55056
    head_commit = a58b2f89deffd12bf5d56c0863b14add57c4af02 (2020-03-25:16:01:28)
    project = github.com/patchguard/qemu_sgx
    path = hw/net/pcnet.c
    
    
16. commit = 91f5122ef0d4187e82ff4d8cbff0e2da74b25a7a
    head_commit = 7659da6827d0c1d6d074f41352aef5aa6e646925 (2020-04-03:12:12:09)
    project = github.com/kevinsuo/xballoon
    path = hypervisor/tools/qemu-xen/hw/net/pcnet.c