Debian Libvirt vulnerabilities

CVE-2016-5008 [CRITICAL] CVE-2016-5008: libvirt - libvirt before 2.0.0 improperly disables password checking when the password on ... libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. Scope: local bookworm: resolved (fixed in 2.0.0-1) bullseye: resolved (fixed in 2.0.0-1) forky: resolved (fixed in 2.0.0-1) sid: resol

CVE-2013-2218 [MEDIUM] CVE-2013-2218: libvirt - Double free vulnerability in the virConnectListAllInterfaces method in interface... Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command. Scope: local bookworm: resolved (fixed in 1.1.0-1)

CVE-2019-10132 [HIGH] CVE-2019-10132: libvirt - A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and ... A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. Scope: local bookworm: resolved (fixed i

CVE-2020-14339 [HIGH] CVE-2020-14339: libvirt - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/... A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the

CVE-2009-0036 [MEDIUM] CVE-2009-0036: libvirt - Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c i... Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check. Scope: local bookw

CVE-2019-10167 [HIGH] CVE-2019-10167: libvirt - The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 ... The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to

CVE-2019-10168 [HIGH] CVE-2019-10168: libvirt - The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvi... The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argu

CVE-2019-10166 [HIGH] CVE-2019-10166: libvirt - It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5... It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arb

CVE-2013-4401 [HIGH] CVE-2013-4401: libvirt - The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 chec... The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information. Scope: local bookworm: resolved (fixed in 1.1

CVE-2016-10746 [HIGH] CVE-2016-10746: libvirt - libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by ... libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886. Scope: local bookworm: resolved (fixed in 1.3.1-1) bullseye: resolved (fixed in 1.3.1-1) forky: resolved (fixed in 1.3.1-1) sid: resolved (fixed in

CVE-2019-10161 [HIGH] CVE-2019-10161: libvirt - It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit re... It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of servi

CVE-2017-1000256 [HIGH] CVE-2017-1000256: libvirt - libvirt version 2.3.0 and later is vulnerable to a bad default configuration of ... libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default. Scope: local bookworm: resolved (fixed in 3.8.0-3) bullseye: resolved (fixed in 3.8.0-3) forky: resolved (fixed in 3.8.0-3) sid: resolved (fixed in 3.8.0-3) trixie: resolved

CVE-2018-6764 [HIGH] CVE-2018-6764: libvirt - util/virlog.c in libvirt does not properly determine the hostname on LXC contain... util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module. Scope: local bookworm: resolved (fixed in 4.0.0-2) bullseye: resolved (fixed in 4.0.0-2) forky: resolved (fixed in 4.0.0-2) sid: resol

CVE-2018-1064 [HIGH] CVE-2018-1064: libvirt - libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a res... libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. Scope: local bookworm: resolved (fixed in 4.1.0-1) bullseye: resolved (fixed in 4.1.0-1) forky: resolved (fixed in 4.1.0-1) sid: resolved (fixed in 4.1.0-1) trixie: resolved (f

CVE-2013-0170 [MEDIUM] CVE-2013-0170: libvirt - Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserv... Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a messag

CVE-2011-4600 [MEDIUM] CVE-2011-4600: libvirt - The networkReloadIptablesRules function in network/bridge_driver.c in libvirt be... The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query. Scope: local bookworm: resolved (fixed in 0.9.9-1) bullseye: resolved (fixed in 0.9

CVE-2021-3667 [MEDIUM] CVE-2021-3667: libvirt - An improper locking issue was found in the virStoragePoolLookupByTargetPath API ... An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent oth

CVE-2018-5748 [HIGH] CVE-2018-5748: libvirt - qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (me... qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. Scope: local bookworm: resolved (fixed in 4.0.0-1) bullseye: resolved (fixed in 4.0.0-1) forky: resolved (fixed in 4.0.0-1) sid: resolved (fixed in 4.0.0-1) trixie: resolved (fixed in 4.0.0-1)

CVE-2020-10703 [MEDIUM] CVE-2020-10703: libvirt - A NULL pointer dereference was found in the libvirt API responsible introduced i... A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection co

CVE-2021-3975 [MEDIUM] CVE-2021-3975: libvirt - A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function... A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this fl