CVE-2015-0236

Publication date 29 January 2015

Last updated 24 July 2024

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libvirt	15.10 wily	Not affected
	15.04 vivid	Not affected
	14.10 utopic	Ignored
	14.04 LTS trusty	Fixed 1.2.2-0ubuntu13.1.16
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Ignored

How can I get the fixes?
What do statuses mean?
Patch details

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libvirt	Upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=e99c25ca63c695a63b4c9b91ee956be4fb660772 Upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=8107c1e3694ba4685960ec09868076379718f037

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2867-1
libvirt vulnerabilities
12 January 2016

Other references

http://security.libvirt.org/2015/0001.html
https://www.cve.org/CVERecord?id=CVE-2015-0236