CVE-2014-5177
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1)…
Does this matter?
Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.
Description
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.
- CVSS 2.0
- 1.2 LOWAV:L/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 0.53% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- redhat/enterprise virtualization · opensuse/opensuse · redhat/enterprise linux · redhat/libvirt
- Source
- cve@mitre.org
References
- http://libvirt.org/news.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html
- http://rhn.redhat.com/errata/RHSA-2014-0560.html
- http://secunia.com/advisories/60895
- http://security.gentoo.org/glsa/glsa-201412-04.xml
- http://security.libvirt.org/2014/0003.htmlPatch, Vendor Advisory
- http://www.ubuntu.com/usn/USN-2366-1
- http://libvirt.org/news.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html
- http://rhn.redhat.com/errata/RHSA-2014-0560.html
- http://secunia.com/advisories/60895
- http://security.gentoo.org/glsa/glsa-201412-04.xml
- http://security.libvirt.org/2014/0003.htmlPatch, Vendor Advisory
- http://www.ubuntu.com/usn/USN-2366-1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.