Lucene search

UbuntuUSN-2867-1

HistoryJan 12, 2016 - 12:00 a.m.

libvirt vulnerabilities

2016-01-1200:00:00

ubuntu.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

70.5%

JSON

Releases

Ubuntu 15.10
Ubuntu 15.04
Ubuntu 14.04 ESM
Ubuntu 12.04

Packages

libvirt - Libvirt virtualization toolkit

Details

It was discovered that libvirt incorrectly handled the firewall rules on
bridge networks when the daemon was restarted. This could result in an
unintended firewall configuration. This issue only applied to Ubuntu 12.04
LTS. (CVE-2011-4600)

Peter Krempa discovered that libvirt incorrectly handled locking when
certain ACL checks failed. A local attacker could use this issue to cause
libvirt to stop responding, resulting in a denial of service. This issue
only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

Luyao Huang discovered that libvirt incorrectly handled VNC passwords in
shapshot and image files. A remote authenticated user could use this issue
to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04
LTS. (CVE-2015-0236)

Han Han discovered that libvirt incorrectly handled volume creation
failure when used with NFS. A remote authenticated user could use this
issue to cause libvirt to crash, resulting in a denial of service. This
issue only applied to Ubuntu 15.10. (CVE-2015-5247)

Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly
performed storage pool name validation. A remote authenticated user could
use this issue to bypass ACLs and gain access to unintended files. This
issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10.
(CVE-2015-5313)

OSVersionArchitecturePackageVersionFilename
Ubuntu15.10noarchlibvirt-bin< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt-bin-dbgsym< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt-dev< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt-dev-dbgsym< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt-doc< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt0< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt0-dbg< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.10noarchlibvirt0-dbgsym< 1.2.16-2ubuntu11.15.10.2UNKNOWN
Ubuntu15.04noarchlibvirt-bin< 1.2.12-0ubuntu14.4UNKNOWN
Ubuntu15.04noarchlibvirt-bin-dbgsym< 1.2.12-0ubuntu14.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	15.10	noarch	libvirt-bin	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt-bin-dbgsym	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt-dev	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt-dev-dbgsym	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt-doc	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt0	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt0-dbg	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.10	noarch	libvirt0-dbgsym	< 1.2.16-2ubuntu11.15.10.2	UNKNOWN
Ubuntu	15.04	noarch	libvirt-bin	< 1.2.12-0ubuntu14.4	UNKNOWN
Ubuntu	15.04	noarch	libvirt-bin-dbgsym	< 1.2.12-0ubuntu14.4	UNKNOWN