SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2014-0179

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1)…

LOW 1.9EPSS 0.56%

Does this matter?

Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own.

Description

libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.

CVSS 2.0
1.9 LOWAV:L/AC:M/Au:N/C:N/I:N/A:P
EPSS
0.56% probability · 45th percentile
CISA KEV
Not listed
Weakness
CWE-20
Affected
redhat/libvirt · redhat/enterprise virtualization · opensuse/opensuse · redhat/enterprise linux
Source
secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.