CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-5008 – libvirt: Setting empty VNC password allows access to unauthorized users
https://notcve.org/view.php?id=CVE-2016-5008
02 Jul 2016 — libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. libvirt en versiones anteriores a 2.0.0 desactiva inadecuadamente la comprobación de contraseñas cuando la contraseña en un servidor VNC está establecida en una cadena vacía, lo que permite a atacantes remotos eludir la autenticación y establecer una sesióin VNC conectándose al s... • http://lists.opensuse.org/opensuse-updates/2016-07/msg00054.html • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3672
https://notcve.org/view.php?id=CVE-2014-3672
25 May 2016 — The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr. La implementación de qemu en libvirt en versiones anteriores a 1.3.0 y Xen permite a usuarios locales del SO invitado provocar una denegación de servicio (consumo de disco anfitrión) escribiendo stdout o stderr. • http://www.openwall.com/lists/oss-security/2016/05/24/5 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2015-5247 – Ubuntu Security Notice USN-2867-1
https://notcve.org/view.php?id=CVE-2015-5247
12 Jan 2016 — The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool. La API virStorageVolCreateXML en libvirt 1.2.14 hasta la versión 1.2.19 permite a usuarios remotos autenticados con una conexión de lectura-escritura causar una denegación de servicio (caída de libvirtd) desencadenando una desvinculación fallida después de c... • http://security.libvirt.org/2015/0003.html • CWE-284: Improper Access Control •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4600 – Ubuntu Security Notice USN-2867-1
https://notcve.org/view.php?id=CVE-2011-4600
12 Jan 2016 — The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query. La función networkReloadIptablesRules en network/bridge_driver.c en libvirt en versiones anteriores a 0.9.9 no maneja correctamente las reglas del firewall en redes puente cuando se reinicia libvirtd, lo que podría permitir a a... • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=ae1232b298323dd7bef909426e2ebafa6bca9157 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2015-0236 – libvirt: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects
https://notcve.org/view.php?id=CVE-2015-0236
29 Jan 2015 — libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. libvirt anterior a 1.2.12 permite a usuarios remotos autenticados obtener la contraseña VNC mediante el uso del indicador VIR_DOMAIN_XML_SECURE con (1) una instantánea manipulada a la interfaz virDomainSnapshotGetXMLDesc o (2) una imagen manipulada a la int... • http://advisories.mageia.org/MGASA-2015-0046.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8131 – Gentoo Linux Security Advisory 201412-36
https://notcve.org/view.php?id=CVE-2014-8131
26 Dec 2014 — The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access. La implementación qemu de virConnectGetAllDomainStats en libvirt anterior a 1.2.11 no maneja correctamente los bloqueos cuando se salta un dominio debido a las restric... • http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 108EXPL: 0CVE-2013-4399 – Gentoo Linux Security Advisory 201412-04
https://notcve.org/view.php?id=CVE-2013-4399
08 Dec 2014 — The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection. La función remoteClientFreeFunc en daemon/remote.c en libvirt anterior a 1.1.3, cuando ACLs están utilizados, no fija una identidad, lo que causa que la eliminación del manejador de eventos se denie... • http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=8294aa0c1750dcb49d6345cd9bd97bf421580d8b •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2014-7823 – libvirt: dumpxml: information leak with migratable flag
https://notcve.org/view.php?id=CVE-2014-7823
11 Nov 2014 — The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. El virDomainGetXMLDesc API en Libvirt en versiones anteriores a 1.2.11 permite a usuarios remotos de solo lectura obtener la contraseña VNC utilizando el marcador VIR_DOMAIN_XML_MIGRATABLE, lo que desencadena el uso del marcador VIR_DOMAIN_XML_SECURE. It was found that when the VIR_DOMAIN_XML_MIGRA... • http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 1%CPEs: 9EXPL: 0CVE-2014-3657 – libvirt: domain_conf: domain deadlock DoS
https://notcve.org/view.php?id=CVE-2014-3657
02 Oct 2014 — The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command. La función virDomainListPopulate en conf/domain_conf.c en libvirt anterior a 1.2.9 no limpia el bloqueo en la lista de dominios, lo que permite a atacantes remotos causar una denegación de servicio (bloqueo mutuo) a través d... • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669 • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 3%CPEs: 12EXPL: 0CVE-2014-3633 – libvirt: qemu: out-of-bounds read access in qemuDomainGetBlockIoTune() due to invalid index
https://notcve.org/view.php?id=CVE-2014-3633
30 Sep 2014 — The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read. La función qemuDomainGetBlockIoTune en qemu/qemu_driver.c en libvirt anterior a 1.2.9, cuando un disco ha sido conectado en caliente o eliminado de la imagen en vivo, permite a atacantes remotos ca... • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=3e745e8f775dfe6f64f18b5c2fe4791b35d3546b • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •