Directory Traversal

libvirt.so is vulnerable to directory traversals. A malicious user with storagevol:create permissions can write arbitrary files on the volume without the domain:write permission permission through the virStorageBackendFileSystemVolCreate function in storagebackendfs.c...

FreeBSD : libvirt -- ACL bypass using ../ to access beyond storage pool (f714b4c9-a6c1-11e5-88d7-047d7b492d07)

Libvit development team reports : Various virStorageVol API operate on user-supplied volume names by concatenating the volume name to the pool location. Note that the virStoragePoolListVolumes API, when used on a storage pool backed by a directory in a file system, will only list volumes...

CVE-2013-4401

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained fr...

PT-2013-4999

Name of the Vulnerable Software and Affected Versions libvirt versions 1.1.0 through 1.1.3 Description The issue concerns the virConnectDomainXMLToNative API function, which incorrectly checks for the connect:read permission instead of the connect:write permission. This allows attackers to gain...