Redhat Libvirt
73 CVEs affecting Redhat Libvirt. Latest disclosed: 2024-08-30. Critical: 1, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5008 | Critical | 9.8 | 2016-07-13 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass… |
CVE-2020-14339 | High | 8.8 | 2020-12-03 | A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged oper… |
CVE-2019-10132 | High | 8.8 | 2019-05-22 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration paramet… |
CVE-2017-1000256 | High | 8.1 | 2017-10-31 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate S… |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10166 | High | 7.8 | 2019-08-02 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML()… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2018-6764 | High | 7.8 | 2018-02-23 | util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container p… |
CVE-2017-2635 | High | 7.7 | 2018-08-22 | A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to cra… |
CVE-2016-10746 | High | 7.5 | 2019-04-18 | libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed t… |
CVE-2018-1064 | High | 7.5 | 2018-03-28 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now al… |
CVE-2018-5748 | High | 7.5 | 2018-01-25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. |
CVE-2020-25637 | Medium | 6.7 | 2020-10-06 | A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of… |
CVE-2023-3750 | Medium | 6.5 | 2023-07-24 | A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of se… |
CVE-2021-3975 | Medium | 6.5 | 2022-08-23 | A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being… |
CVE-2021-4147 | Medium | 6.5 | 2022-03-25 | A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting… |
CVE-2021-3667 | Medium | 6.5 | 2022-03-02 | An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a loc… |
CVE-2020-14301 | Medium | 6.5 | 2021-05-27 | An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML du… |
CVE-2020-10701 | Medium | 6.5 | 2021-05-27 | A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to a… |