Unscored severity · published Aug 3, 2014
CVE-2014-0179
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity…
–
CVSS
0.6%
EPSS
No
On KEV
Description
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
6.0 · source: NVD
EV
Enterprise Virtualization · Redhat
3.0 · source: NVD
LI
Libvirt · Redhat
0.7.5; 0.7.6; 0.7.7; 0.8.0; 0.8.1; 0.8.2; +34 more · source: NVD
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0179
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0179
libvirt.org
http://libvirt.org/news.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0560.html
secunia.com
http://secunia.com/advisories/60895
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201412-04.xml
More from Opensuse
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability