CVE-2015-0236

CVE-2015-0236 affects libvirt before 1.2.12. Remote authenticated users can obtain VNC passwords by abusing VIR_DOMAIN_XML_SECURE flag in two XML-descending interfaces (virDomainSnapshotGetXMLDesc and virDomainSaveImageGetXMLDesc). The issue is tied to libvirt’s handling of XML data under the VIR...