SB2014080301 - Input validation error in libvirt

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014080301

SB2014080301 - Input validation error in libvirt

Published: August 3, 2014 Updated: July 28, 2020

Security Bulletin ID SB2014080301
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2014-0179)

The vulnerability allows local users to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors.


Remediation

Install update from vendor's website.

References