CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8131
https://notcve.org/view.php?id=CVE-2014-8131
The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access. La implementación qemu de virConnectGetAllDomainStats en libvirt anterior a 1.2.11 no maneja correctamente los bloqueos cuando se salta un dominio debido a las restricciones ACL, lo que permite a usuarios remotos autenticados causar una denegación de servicio (bloqueo o fallo de segmentación y caída) a través de una solicitud de acceso cuando el usuario no tiene los privilegios de acceso. • http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html http://security.libvirt.org/2014/0008.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 1%CPEs: 108EXPL: 0CVE-2013-4399
https://notcve.org/view.php?id=CVE-2013-4399
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection. La función remoteClientFreeFunc en daemon/remote.c en libvirt anterior a 1.1.3, cuando ACLs están utilizados, no fija una identidad, lo que causa que la eliminación del manejador de eventos se deniega y atacantes remotos causan una denegación de servicio (uso después de liberación y caída) mediante el registro de un manejador de eventos y posteriormente el cierre de la conexión. • http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=8294aa0c1750dcb49d6345cd9bd97bf421580d8b http://secunia.com/advisories/60895 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2013/0013.html http://www.securityfocus.com/bid/62972 •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2014-7823 – libvirt: dumpxml: information leak with migratable flag
https://notcve.org/view.php?id=CVE-2014-7823
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. El virDomainGetXMLDesc API en Libvirt en versiones anteriores a 1.2.11 permite a usuarios remotos de solo lectura obtener la contraseña VNC utilizando el marcador VIR_DOMAIN_XML_MIGRATABLE, lo que desencadena el uso del marcador VIR_DOMAIN_XML_SECURE. It was found that when the VIR_DOMAIN_XML_MIGRATABLE flag was used, the QEMU driver implementation of the virDomainGetXMLDesc() function could bypass the restrictions of the VIR_DOMAIN_XML_SECURE flag. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to leak certain limited information from the domain XML data. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html http://secunia.com/advisories/60010 http://secunia.com/advisories/60895 http://secunia.com/advisories/62058 http://secunia.com/advisories/62303 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2014/0007.html http://www.ubuntu.com/usn/USN-2404-1 https://access.redhat.com/security/cve/CVE-2014-7823 https://bugzilla.redhat.com/show_bug.cgi?id=1160817 • CWE-255: Credentials Management Errors •
CVSS: 5.0EPSS: 3%CPEs: 9EXPL: 0CVE-2014-3657 – libvirt: domain_conf: domain deadlock DoS
https://notcve.org/view.php?id=CVE-2014-3657
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command. La función virDomainListPopulate en conf/domain_conf.c en libvirt anterior a 1.2.9 no limpia el bloqueo en la lista de dominios, lo que permite a atacantes remotos causar una denegación de servicio (bloqueo mutuo) a través de un valor nulo en el parámetro second en el comando de API virConnectListAllDomains. A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive. • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669 http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html http://rhn.redhat.com/errata/RHSA-2014-1352.html http://secunia.com/advisories/60291 http://secunia.com/advisories/62303 http://security.libvirt.org/2014/0005.html http://www.ubuntu.com/usn/USN-2404-1 https://access.redhat.com/security/cve/CVE-2014-3657 https&# • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 5.8EPSS: 3%CPEs: 12EXPL: 0CVE-2014-3633 – libvirt: qemu: out-of-bounds read access in qemuDomainGetBlockIoTune() due to invalid index
https://notcve.org/view.php?id=CVE-2014-3633
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read. La función qemuDomainGetBlockIoTune en qemu/qemu_driver.c en libvirt anterior a 1.2.9, cuando un disco ha sido conectado en caliente o eliminado de la imagen en vivo, permite a atacantes remotos causar una denegación de servicio (caída) o leer información sensible de la memoria dinámica a través de una consulta blkiotune manipulada, lo que provoca una lectura fuera de rango. An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process. • http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=3e745e8f775dfe6f64f18b5c2fe4791b35d3546b http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html http://rhn.redhat.com/errata/RHSA-2014-1352.html http://secunia.com/advisories/60291 http://secunia.com/advisories/60895 http://security.gentoo.org/glsa/glsa-201412-04.xml http://security.libvirt.org/2014/0004.html http://www.debian.org/security/2014/dsa-3038 h • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •