CVE-2015-0236
Fixed in a distro release EPSS 2%
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
Products: mageia, redhat libvirt, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvirt | 1.2.9-8 |
| Debian 13 | libvirt | 1.2.9-8 |
| Debian 14 | libvirt | 1.2.9-8 |
| Red Hat Enterprise Linux 7 | libvirt | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-client | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-config-network | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-config-nwfilter | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-interface | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-lxc | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-network | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-nodedev | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-nwfilter | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-qemu | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-secret | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-storage | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-kvm | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-lxc | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-debuginfo | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-devel | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-docs | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-lock-sanlock | 0:1.2.8-16.el7 |
| Red Hat Enterprise Linux 7 | libvirt-login-shell | 0:1.2.8-16.el7 |
| Red Hat storage 3.1 server el7 | libvirt-daemon-lxc | 0:1.2.8-16.el7 |
| Red Hat storage 3.1 server el7 | libvirt-debuginfo | 0:1.2.8-16.el7 |
| Red Hat storage 3.1 server el7 | libvirt-lock-sanlock | 0:1.2.8-16.el7 |
| Red Hat storage 3.1 server el7 | libvirt-login-shell | 0:1.2.8-16.el7 |
| SUSE Linux Enterprise Desktop 12 | libvirt | 1.2.5-27.10.1 |
| SUSE Linux Enterprise Server 12 | libvirt | 1.2.5-27.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libvirt | 1.2.5-27.10.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libvirt | 1.2.5-27.10.1 |
| SUSE Linux Enterprise Workstation Extension 12 | libvirt | 1.2.5-27.10.1 |
| Ubuntu 14.04 LTS | libvirt | 1.2.2-0ubuntu13.1.16 |
| openSUSE Tumbleweed | libvirt | 2.5.0-1.1 |