Debian Libvirt vulnerabilities

CVE-2010-2237 [MEDIUM] CVE-2010-2237: libvirt - Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores with... Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors. Scope: local bookworm: resolved (fixed in 0.8.3-1) bullseye: resolved (fixed in 0.8.3-1) forky: re

CVE-2014-0028 [MEDIUM] CVE-2014-0028: libvirt - libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the dom... libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API. Scope: local bookworm: resolved (fixed in 1.

CVE-2013-4239 [MEDIUM] CVE-2013-4239: libvirt - The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1... The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function. Scope: local bookworm: resolved (fixed in 1.1.2~rc1-1) bullseye: resolved (fixed in 1.1.2~rc1-1) forky: resolved (fixed in 1.

CVE-2014-8131 [MEDIUM] CVE-2014-8131: libvirt - The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 ... The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access. Scope: local bookworm:

CVE-2015-0236 [LOW] CVE-2015-0236: libvirt - libvirt before 1.2.12 allow remote authenticated users to obtain the VNC passwor... libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. Scope: local bookworm: resolved (fixed in 1.2.9-8) bullseye: resolved (fixed in 1.2.9-8) forky: resolved (fixed in 1

CVE-2013-4296 [MEDIUM] CVE-2013-4296: libvirt - The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1... The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call. Scope: local bookworm: resolved (fixed in 1.1.4-1) bullseye: reso

CVE-2013-4311 [HIGH] CVE-2013-4311: libvirt - libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.... libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. Scope: local bookworm: resolved (fixed in 1.1.3~rc1-1) bullseye: reso

CVE-2013-4297 [MEDIUM] CVE-2013-4297: libvirt - The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and ea... The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors. Scope: local bookworm: resolved (fixed in 1.1.2-2) bullseye: resolved (fixed in 1.1.2-2) forky: resolved (fixed in 1.1.2-2) sid: resolved (fixed in

CVE-2014-5177 [LOW] CVE-2014-5177: libvirt - libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is en... libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePool

CVE-2013-2230 [MEDIUM] CVE-2013-2230: libvirt - The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authe... The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via unspecified vectors involving "multiple events registration." Scope: local bookworm: resolved (fixed in 1.1.0-3) bullseye: resolved (fixed in 1.1.0-3) forky: resolved (fixed in 1.1.0-3) sid: resolved (fixed in 1.1.0-3) trixie

CVE-2012-3445 [LOW] CVE-2012-3445: libvirt - The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly han... The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer. Scope: local bookworm: resolved (fixe

CVE-2015-5313 [LOW] CVE-2015-5313: libvirt - Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate fu... Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. Scope: local bookworm: resolved (fix

CVE-2014-1447 [LOW] CVE-2014-1447: libvirt - Race condition in the virNetServerClientStartKeepAlive function in libvirt befor... Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent. Scope: local bookworm: resolved (fixed in 1.2.1-1) bullseye: resolved (fixed in 1.2.1-1) forky: resolved (fixed in 1.2.1-1) sid: resolved (fixed in 1.2.

CVE-2012-2693 [LOW] CVE-2012-2693: libvirt - libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual... libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices. Scope: local bookworm: resolved (fixed in 0.9.12-1) bullseye: resolved (fixed in 0.9.12-1) fork

CVE-2013-1766 [LOW] CVE-2013-1766: libvirt - libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which al... libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.9.12-8) bullseye: resolved (fixed in 0.9.12-8) forky: resolved (fixed in 0.9.12-8) sid: resolved (fixed in 0.9.12-8) trixie: resolved (fixed in 0.9.12-8)

CVE-2011-1486 [LOW] CVE-2011-1486: libvirt - libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which... libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time. Scope: local bookworm: resolved (fixed in 0.9.0-1) bullseye: resolved (fixed in 0.9.0-1) forky: resolved (fixed in 0.9.0-1) sid: resolved (fixed in 0.9.0-1) trixie: r

CVE-2014-0179 [LOW] CVE-2014-0179: libvirt - libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of... libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT

CVE-2010-2242 [LOW] CVE-2010-2242: libvirt - Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mapping... Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree. Scope: local bookworm: resolved (fixed in 0.8.3-1) bullseye: resolved (fixed in 0.

CVE-2013-4292 [LOW] CVE-2013-4292: libvirt - libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory ... libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c. Scope: local bookworm: resolved (fixed in 1.1.2~rc2-1) bullseye: resolved (fixed in 1.1.2~rc2-1) forky: resolved (fixed in 1.1.2~rc2-1) sid: resolved (fix

CVE-2014-8135 [LOW] CVE-2014-8135: libvirt - The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.... The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command. Scope: local bookworm: resolved (fixed in 1.2.9-7) bullseye: resolved (fixed in 1.2.9-7) fo