Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 85

Export CSV
CVE-2015-5313

libvirt: filesystem storage volume names path traversal flaw

Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.

CVSS 3.0 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt Storage
CVE-2014-8135

libvirt: local denial of service in storage/storage_driver.c

The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2014-5177

libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read

libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Opensuse Redhat
Products
Opensuse Enterprise Linux Enterprise Virtualization and 1 more
CVE-2014-7823

libvirt: dumpxml: information leak with migratable flag

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2014-8136

libvirt: local denial of service in qemu/qemu_driver.c

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Mageia Opensuse and 1 more
Products
Ubuntu Linux Mageia Opensuse and 7 more
CVE-2014-3657

libvirt: domain_conf: domain deadlock DoS

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux
CVE-2016-5008

libvirt: Setting empty VNC password allows access to unauthorized users

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Libvirt and 1 more
CVE-2014-8131

libvirt: deadlock and segfault in qemuConnectGetAllDomainStats

The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.

CVSS 2.0 · 4.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-6436

libvirt: crash in lxcDomainGetMemoryParameters

The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-1962

libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool

The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2013-5651

libvirt: virBitmapParse out-of-bounds read access

The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4401

libvirt: unintended API access due to incorrect permissions checks

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 8.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-1766

libvirt: kvm-group writable storage

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2011-2178

libvirt: regression introduced in disk probe logic

The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS. NOTE: this vulnerability exists because of a CVE-2010-2238 regression.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4400

libvirt: virt-login-shell arbitrary file overwrites vulnerability

virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-0170

libvirt: use-after-free in virNetMessageFree()

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

CVSS 2.0 · 6.8 Medium EPSS 5.8% KEV · Not listed
Vendors
Canonical Fedoraproject Opensuse and 2 more
Products
Ubuntu Linux Fedora Opensuse and 9 more
CVE-2013-4311

libvirt: insecure calling of polkit

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Enterprise Linux Libvirt
CVE-2013-4297

libvirt: invalid free in virFileNBDDeviceAssociate

The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2012-4423

libvirt: null function pointer invocation in virNetServerProgramDispatchCall()

The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table.

CVSS 2.0 · 5.0 Medium EPSS 3.7% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2011-1486

libvirt: error reporting in libvirtd is not thread safe

libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.

CVSS 2.0 · 3.3 Low EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt Rhel Virtualization