NetSight
IP …
medium6.8

CVE-2013-0170

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before…

Impact

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

Affected products

VendorProductAffected versions
RedhatLibvirt
from 0.9.6 before 0.9.6.4
from 0.9.11 before 0.9.11.9
from 0.10.2 before 0.10.2.3
from 1.0.0 before 1.0.2
OpensuseOpensuse
Versions 12.1, 12.2
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise Server
Version 11
SuseLinux Enterprise Software Development Kit
Version 11
FedoraprojectFedora
Versions 16, 17, 18
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Eus
Version 6.3
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Workstation
Version 6.0
CanonicalUbuntu Linux
Versions 12.04, 12.10

Weakness classification

CWE-416

References