NetSight
IP …
low3.5

CVE-2015-0236

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the vi…

Impact

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

Affected products

VendorProductAffected versions
MageiaMageia
Version 4.0
RedhatLibvirt
through 1.2.11
Versions 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Hpc Node
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-200

References