CVE-2016-5008
Fixed in a distro release EPSS 4%
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
Products: redhat libvirt, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvirt | 2.0.0-1 |
| Debian 13 | libvirt | 2.0.0-1 |
| Debian 14 | libvirt | 2.0.0-1 |
| Debian 7 | libvirt | 0.9.12.3-1+deb7u2 |
| Debian 8 | libvirt | 1.2.9-9+deb8u3 |
| Red Hat Enterprise Linux 7 | libvirt | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-client | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-config-network | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-config-nwfilter | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-interface | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-lxc | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-network | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-nodedev | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-nwfilter | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-qemu | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-secret | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-driver-storage | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-kvm | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-daemon-lxc | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-debuginfo | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-devel | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-docs | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-lock-sanlock | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-login-shell | 0:2.0.0-10.el7 |
| Red Hat Enterprise Linux 7 | libvirt-nss | 0:2.0.0-10.el7 |
| Red Hat storage 3.1 server el7 | libvirt-daemon-lxc | 0:2.0.0-10.el7 |
| Red Hat storage 3.1 server el7 | libvirt-debuginfo | 0:2.0.0-10.el7 |
| Red Hat storage 3.1 server el7 | libvirt-lock-sanlock | 0:2.0.0-10.el7 |
| Red Hat storage 3.1 server el7 | libvirt-login-shell | 0:2.0.0-10.el7 |
| SUSE Linux Enterprise Desktop 12 SP1 | libvirt | 1.2.18.4-11.7 |
| SUSE Linux Enterprise Server 11 SP4 | libvirt | 1.2.5-15.3 |
| SUSE Linux Enterprise Server 11 SP4 | perl-Sys-Virt | 1.2.5-4.2 |
| SUSE Linux Enterprise Server 12 SP1 | libvirt | 1.2.18.4-11.7 |
| SUSE Linux Enterprise Server 12-LTSS | libvirt | 1.2.5-27.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libvirt | 1.2.5-15.3 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | perl-Sys-Virt | 1.2.5-4.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libvirt | 1.2.18.4-11.7 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libvirt | 1.2.5-15.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libvirt | 1.2.18.4-11.7 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | libvirt | 1.2.18.4-11.7 |
| Ubuntu 14.04 LTS | libvirt | 1.2.2-0ubuntu13.1.26 |
| Ubuntu 16.04 LTS | libvirt | 1.3.1-1ubuntu10.19 |