libxl fails to honour readonly flag on disks with qemu-xen

ISSUE DESCRIPTION Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu; and indeed there is no way in qemu to make a disk read-only. The vulnerability is exploitable only via...

CVE-2015-5247

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service libvirtd crash by triggering a failed unlink after creating a volume on a rootsquash NFS pool...

CVE-2015-5279

Heap-based buffer overflow in the ne2000receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service instance crash or possibly execute arbitrary code via vectors related to receiving packets...

Ubuntu 14.04 LTS : Spice vulnerability (USN-2736-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2736-1 advisory. Frediano Ziglio discovered that Spice incorrectly handled monitor configs. A malicious guest could use this issue to cause a denial of service, or possibly execut...

Ubuntu: Security Advisory (USN-2736-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2736-1 spice vulnerability

Frediano Ziglio discovered that Spice incorrectly handled monitor configs. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attacke...

USN-2736-1: Spice vulnerability

Frediano Ziglio discovered that Spice incorrectly handled monitor configs. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attacke...

SOL17218 - Libvirt vulnerability CVE-2014-8135

The storageVolUpload function in storage/storagedriver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service NULL pointer dereference and daemon crash via a crafted offset value in a "virsh vol-upload" command. CVE-2014-8135...

libvirt / qemu multiple security vulnerabilities

Multiple memory corruptions...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2724-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2724-1 advisory. It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE functionality. A malicious guest could possibly use this iss...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2692-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2692-1 advisory. Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a non-default configuration, a malicious guest could use this issue to cause a denia...

USN-2692-1 qemu vulnerabilities

Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a non-default configuration, a malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is use...

USN-2692-1: QEMU vulnerabilities

Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a non-default configuration, a malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is use...

netcf: augeas path expression injection via interface name

A denial of service flaw was found in netcf. A specially crafted interface name could cause an application using netcf such as the libvirt daemon to crash...

Vulnerabilities of the Red Hat Enterprise Linux operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information

The libvirt-0.10.2 package of the Red Hat Enterprise Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of confidentiality, integrity, and accessibility of protected information...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the libvirt-daemon-driver-qemu-1.1.1 package of the Red Hat Enterprise Linux operating system can lead to a violation of the confidentiality and accessibility of protected information. This vulnerability can be exploited remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities of the libvirt-debuginfo-0.10.2 package for the Red Hat Enterprise Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the libvirt-1.1.1 package in the Red Hat Enterprise Linux operating system can lead to a violation of the confidentiality and accessibility of protected information. This vulnerability can be exploited remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information

The libvirt-python-0.10.2 package on the Red Hat Enterprise Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of confidentiality, integrity, and accessibility of protected information...

Vulnerabilities of the Red Hat Enterprise Linux operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libvirt-devel-0.10.2 package of the Red Hat Enterprise Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information...