DEBIAN-CVE-2021-3667

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited...

CVE-2017-15139

CVE-2017-15139 affects OpenStack Cinder up to Queens, specifically ScaleIO volumes using thin volumes with zero padding. The vulnerability can lead to leakage of sensitive data between tenants when new volumes are created in certain configurations. Public documentation in connected items confirms...

CVE-2017-15139

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive...

Unauthorized Access Vulnerability in glusterfs server

glusterfs server is an open source scalable network file system . A security vulnerability exists in glusterfs server versions prior to 3.10.12 and prior to 4.0.2. An attacker can exploit this vulnerability to mount a gluster storage data volume...

Privilege escalation

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink...

glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled

A privilege escalation flaw was found in gluster snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink...

Fedora 23 : libvirt-1.2.18.2-1.fc23 (2015-30b347dff1)

Rebased to version 1.2.18.2 disk backend is not removed properly when disk frontent hotplug fails bz 1265968 Fix TPM cancel path on newer kernels bz 1244895 Remove timeout for libvirt-guests.service bz 1195544 CVE-2015-5313 libvirt: filesystem storage volume names path traversal flaw bz 1291433...

UBUNTU-CVE-2015-5313

Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storagebackendfs.c in libvirt, when fine-grained Access Control Lists ACL are in effect, allows local users with storagevol:create ACL but not domain:write permission to write to arbitrary files via ...

PT-2014-5395 · Red Hat · Red Hat Enterprise Virtualization

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization version 3.4 Description: The issue concerns the oVirt storage backend, which fails to wipe memory snapshots when a virtual machine VM is deleted, even if wipe-after-delete WAD is configured for the VM's disk...