CVSS: 4.3EPSS: 1%CPEs: 108EXPL: 0CVE-2013-4399
https://notcve.org/view.php?id=CVE-2013-4399
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection. La función remoteClientFreeFunc en daemon/remote.c en libvirt anterior a 1.1.3, cuando ACLs están utilizados, no fija una identidad, lo que causa que la eliminación del manejador de eventos se deniega y atacantes remotos causan una denegación de servicio (uso después de liberación y caída) mediante el registro de un manejador de eventos y posteriormente el cierre de la conexión. • http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=8294aa0c1750dcb49d6345cd9bd97bf421580d8b http://secunia.com/advisories/60895 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2013/0013.html http://www.securityfocus.com/bid/62972 •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2014-7823 – libvirt: dumpxml: information leak with migratable flag
https://notcve.org/view.php?id=CVE-2014-7823
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. El virDomainGetXMLDesc API en Libvirt en versiones anteriores a 1.2.11 permite a usuarios remotos de solo lectura obtener la contraseña VNC utilizando el marcador VIR_DOMAIN_XML_MIGRATABLE, lo que desencadena el uso del marcador VIR_DOMAIN_XML_SECURE. It was found that when the VIR_DOMAIN_XML_MIGRATABLE flag was used, the QEMU driver implementation of the virDomainGetXMLDesc() function could bypass the restrictions of the VIR_DOMAIN_XML_SECURE flag. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to leak certain limited information from the domain XML data. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html http://secunia.com/advisories/60010 http://secunia.com/advisories/60895 http://secunia.com/advisories/62058 http://secunia.com/advisories/62303 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2014/0007.html http://www.ubuntu.com/usn/USN-2404-1 https://access.redhat.com/security/cve/CVE-2014-7823 https://bugzilla.redhat.com/show_bug.cgi?id=1160817 • CWE-255: Credentials Management Errors •
CVSS: 5.0EPSS: 3%CPEs: 9EXPL: 0CVE-2014-3657 – libvirt: domain_conf: domain deadlock DoS
https://notcve.org/view.php?id=CVE-2014-3657
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command. La función virDomainListPopulate en conf/domain_conf.c en libvirt anterior a 1.2.9 no limpia el bloqueo en la lista de dominios, lo que permite a atacantes remotos causar una denegación de servicio (bloqueo mutuo) a través de un valor nulo en el parámetro second en el comando de API virConnectListAllDomains. A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive. • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669 http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html http://rhn.redhat.com/errata/RHSA-2014-1352.html http://secunia.com/advisories/60291 http://secunia.com/advisories/62303 http://security.libvirt.org/2014/0005.html http://www.ubuntu.com/usn/USN-2404-1 https://access.redhat.com/security/cve/CVE-2014-3657 https&# • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 5.8EPSS: 3%CPEs: 12EXPL: 0CVE-2014-3633 – libvirt: qemu: out-of-bounds read access in qemuDomainGetBlockIoTune() due to invalid index
https://notcve.org/view.php?id=CVE-2014-3633
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read. La función qemuDomainGetBlockIoTune en qemu/qemu_driver.c en libvirt anterior a 1.2.9, cuando un disco ha sido conectado en caliente o eliminado de la imagen en vivo, permite a atacantes remotos causar una denegación de servicio (caída) o leer información sensible de la memoria dinámica a través de una consulta blkiotune manipulada, lo que provoca una lectura fuera de rango. An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process. • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=3e745e8f775dfe6f64f18b5c2fe4791b35d3546b http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html http://rhn.redhat.com/errata/RHSA-2014-1352.html http://secunia.com/advisories/60291 http://secunia.com/advisories/60895 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2014/0004.html http://www.debian.org/security/2014/dsa-3038 h • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.4EPSS: 0%CPEs: 27EXPL: 0CVE-2014-5177 – libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read
https://notcve.org/view.php?id=CVE-2014-5177
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors. libvirt 1.0.0 hasta 1.2.x anterior a 1.2.5, cuando el control de acceso detallado está habilitado, permite a usuarios locales leer ficheros arbitrarios a través de un documento XML manipulado que contiene una declaración de entidad externa XML en conjunto con una referencia de entidad en el método API (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU o (19) virConnectBaselineCPU, relacionado con un problema de entidad externa XML (XXE). NOTA: este problema ha sido dividido (SPLIT) del CVE-2014-0179 por ADT3 debido a las diferentes versiones afectadas de algunos vectores. It was found that libvirt passes the XML_PARSE_NOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read the contents of that file (limited to libvirt as shipped with Red Hat Enterprise Linux 7); parsing an XML document with an entity pointing to a special file that blocks on read access could cause libvirtd to hang indefinitely, resulting in a denial of service on the system. • http://libvirt.org/news.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html http://rhn.redhat.com/errata/RHSA-2014-0560.html http://secunia.com/advisories/60895 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2014/0003.html http://www.ubuntu.com/usn/USN-2366-1 https://access.redhat.com/security/cve/CVE-2014-5177 https://bugzilla.redhat.com/show_bug.cg • CWE-20: Improper Input Validation CWE-611: Improper Restriction of XML External Entity Reference •