CVE-2011-2511

2011-07-1200:00:00

ubuntu.com

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.022 Low

EPSS

Percentile

89.4%

JSON

Integer overflow in libvirt before 0.9.3 allows remote authenticated users
to cause a denial of service (libvirtd crash) and possibly execute
arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers
memory corruption.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633630>

Notes

Author	Note
jdstrand	DoS is confirmed by a remote authenticated user 89d994ad6b0e8ebe9a2cd4e0e37119ff4c917550 (gnulib) may not actually be required to fix in stable releases. fixed in 0.8.3-5+squeeze2

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchlibvirt< 0.7.5-5ubuntu27.16UNKNOWN
ubuntu10.10noarchlibvirt< 0.8.3-1ubuntu19.1UNKNOWN
ubuntu11.04noarchlibvirt< 0.8.8-1ubuntu6.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	libvirt	< 0.7.5-5ubuntu27.16	UNKNOWN
ubuntu	10.10	noarch	libvirt	< 0.8.3-1ubuntu19.1	UNKNOWN
ubuntu	11.04	noarch	libvirt	< 0.8.8-1ubuntu6.5	UNKNOWN