CVE-2014-0179

Publication date 3 August 2014

Last updated 24 July 2024

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libvirt	14.04 LTS trusty	Fixed 1.2.2-0ubuntu13.1.5
	13.10 saucy	Ignored
	12.10 quantal	Ignored
	12.04 LTS precise	Fixed 0.9.8-2ubuntu17.20
	10.04 LTS lucid	Fixed 0.7.5-5ubuntu27.25

Notes

mdeslaur

non-default configuration

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libvirt	Upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=d6b27d3e4c40946efa79e91d134616b41b1666c4 Upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=be7a5de9d0c406f36efae3230e1743c613ad6945

References

Related Ubuntu Security Notices (USN)