Directory Traversal

libvirt.so is vulnerable to directory traversals. A malicious user with storagevol:create permissions can write arbitrary files on the volume without the domain:write permission permission through the virStorageBackendFileSystemVolCreate function in storagebackendfs.c...

CVE-2015-5313: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storagebackendfs.c in libvirt, when fine-grained Access Control Lists ACL are in effect, allows local users with storagevol:create ACL but not domain:write permission to write to arbitrary files via ...