Input validation error in libvirt - CVE-2014-0179
Published: August 3, 2014 / Updated: July 28, 2020
Vulnerability identifier: #VU32532
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2014-0179
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: libvirt.org
Affected software:
libvirt
libvirt
Detailed vulnerability description
The vulnerability allows local users to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors.
How to mitigate CVE-2014-0179
Update to version 1.2.5.
Sources
- http://libvirt.org/news.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html
- http://rhn.redhat.com/errata/RHSA-2014-0560.html
- http://secunia.com/advisories/60895
- http://security.gentoo.org/glsa/glsa-201412-04.xml
- http://security.libvirt.org/2014/0003.html
- http://www.debian.org/security/2014/dsa-3038
- http://www.ubuntu.com/usn/USN-2366-1