CVE-2020-15708
published 2020-11-06CVE-2020-15708: Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary…
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | libvirt | — | — |
| redhat | libvirt | >= 0 < 6.0.0-0ubuntu8.3 | 6.0.0-0ubuntu8.3 |
| ubuntu | libvirt | >= unspecified < 6.0.0-0ubuntu8.3 | 6.0.0-0ubuntu8.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH