Vulnerabilities

TI-2024-07634 CVE-2024-8235 · GHSA-94ch-6cfh-xxgc

Libvirt: crash of virtinterfaced via virconnectlistinterfaces()

LOW 27

A flaw was found in libvirt.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00242 Published 2024-08-30 Partial fix · 10.7.0, 10.5.0-7.el9_5 CWE-476

TI-2024-02322 CVE-2024-2496 · GHSA-mfxp-38jc-24qj

Libvirt: null pointer dereference in udevconnectlistallinterfaces()

LOW 24

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00253 Published 2024-03-18 Partial fix · 9.7.0, 10.0.0-6.el9_4 CWE-476

TI-2023-03503 CVE-2023-3750 · GHSA-35p2-9fg3-f2p2

Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service

LOW 30

A flaw was found in libvirt.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0076 Published 2023-07-24 Fixed in 9.5.0-7.el9_3 CWE-667

TI-2023-02528 CVE-2023-2700 · GHSA-v972-h57q-v8pw

Memory leak in libvirt

LOW 24

A vulnerability was found in libvirt.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00253 Published 2023-05-15 Partial fix CWE-401

TI-2021-02872 CVE-2021-3975 · GHSA-pg89-46xq-98vv

Use after free in libvirt

LOW 32

A use-after-free flaw was found in libvirt.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01642 Published 2022-08-23 Partial fix CWE-416

TI-2022-00801 CVE-2022-0897 · GHSA-4r2g-j5rc-7wqf

A flaw was found in the libvirt nwfilter driver.

LOW 22

A flaw was found in the libvirt nwfilter driver.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01049 Published 2022-03-25 Partial fix CWE-667

TI-2021-03021 CVE-2021-4147 · GHSA-hh52-g3xv-6xxc

A flaw was found in the libvirt libxl driver.

LOW 28

A flaw was found in the libvirt libxl driver.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00244 Published 2022-03-25 No fix listed CWE-667

TI-2021-02608 CVE-2021-3667 · GHSA-q27q-h2jw-qq6c

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of…

LOW 32

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01366 Published 2022-03-02 Partial fix CWE-667

TI-2021-02576 CVE-2021-3631 · GHSA-4225-xq9f-4ww3

Incorrect permission assignment in libvirt

LOW 31

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.00493 Published 2022-03-02 Partial fix CWE-732

TI-2020-11172 CVE-2020-14301 · GHSA-5qrf-45p7-8vrc

An information disclosure vulnerability was found in libvirt in versions before 6.3.0.

LOW 31

An information disclosure vulnerability was found in libvirt in versions before 6.3.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01163 Published 2021-05-27 Partial fix CWE-212

TI-2020-08602 CVE-2020-10701 · GHSA-rhq9-pr9r-9x2j

Missing authorization in libvirt

LOW 30

A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00861 Published 2021-05-27 No fix listed CWE-862

TI-2021-02510 CVE-2021-3559 · GHSA-4236-36gg-25m7

Memory corruption in libvirt

LOW 31

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01033 Published 2021-05-24 No fix listed CWE-119

TI-2020-11210 CVE-2020-14339 · GHSA-c772-g5j9-w9w8

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control`…

LOW 38

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00421 Published 2020-12-03 Partial fix CWE-772

TI-2020-15655 CVE-2020-25637 · GHSA-2qf3-2mv6-pggh

Double free in libvirt

LOW 30

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00529 Published 2020-10-06 Partial fix CWE-415

TI-2020-08604 CVE-2020-10703 · GHSA-c69p-28r6-q952

NULL pointer dereference in libvirt

LOW 33

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02383 Published 2020-06-02 Partial fix · 6.0.0 CWE-476

TI-2020-09947 CVE-2020-12430 · GHSA-mm94-82mx-j73h

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt…

LOW 33

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02275 Published 2020-04-28 No fix listed CWE-401

TI-2019-14711 CVE-2019-20485 · GHSA-9283-64xm-984q

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during…

LOW 27

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00813 Published 2020-03-19 Partial fix CWE-20

TI-2019-07489 CVE-2019-10168 · GHSA-v3hc-v42h-rp66

Improper access control in libvirt

LOW 35

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00549 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250

TI-2019-07488 CVE-2019-10167 · GHSA-5p5j-3wqp-w634

Improper access control in libvirt

LOW 35

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00521 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250

TI-2019-07487 CVE-2019-10166 · GHSA-g9cg-gvh5-48hm

Improper access control in libvirt

LOW 34

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state fil…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00469 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-284

TI-2019-07482 CVE-2019-10161 · GHSA-6cwp-pxj6-56c7

Improper access control in libvirt

LOW 35

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00516 Published 2019-07-30 Fixed CWE-284

TI-2019-07455 CVE-2019-10132 · GHSA-gf34-qgv2-76mf

Incorrect permission assignment in libvirt

MEDIUM 41

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units.

CVSS 3.0HIGH 8.8 Local Low privileges No interaction EPSS 0.01373 Published 2019-05-22 Fixed CWE-732

TI-2016-08786 CVE-2016-10746 · GHSA-66gq-pc92-3m6j

libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest…

LOW 37

libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0207 Published 2019-04-18 No fix listed CWE-254

TI-2019-02896 CVE-2019-3886 · GHSA-wxvx-hq9w-75x9

Missing authorization in libvirt

LOW 27

An incorrect permissions check was discovered in libvirt 4.8.0 and above.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.01117 Published 2019-04-04 Partial fix CWE-862

TI-2019-02852 CVE-2019-3840 · GHSA-rx4m-pcxc-jchp

NULL pointer dereference in libvirt

LOW 31

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent.

CVSS 3.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.01482 Published 2019-03-27 Fixed CWE-476

Vulnerabilities

Filters