Published: 19/08/2010 Updated: 30/10/2010

CVSS v2 Base Score: 4.4 | Impact Score: 6.9 | Exploitability Score: 2.7

VMScore: 392

Vector: AV:L/AC:M/Au:S/C:C/I:N/A:N

Red Hat libvirt, possibly 0.6.0 up to and including 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libvirt libvirt 0.7.0
libvirt libvirt 0.7.1
libvirt libvirt 0.7.2
libvirt libvirt 0.8.1
libvirt libvirt 0.8.2
libvirt libvirt 0.6.4
libvirt libvirt 0.6.5
libvirt libvirt 0.7.7
libvirt libvirt 0.8.0
libvirt libvirt 0.6.2
libvirt libvirt 0.6.3
libvirt libvirt 0.7.5
libvirt libvirt 0.7.6
libvirt libvirt 0.6.1
libvirt libvirt 0.7.3
libvirt libvirt 0.7.4
libvirt libvirt 0.6.0

Synopsis Low: libvirt security and bug fix update Type/Severity Security Advisory: Low Topic Updated libvirt packages that fix two security issues and three bugs arenow available for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having lowsecurity impact Common Vuln ...

This update restores ‘host_device’ support for domain XML on Ubuntu 1004 LTS ...

Guest VMs could be made to circumvent security protections to access resources on the host ...

This update reenables recent bug fixes ...

Updated virtinst for use with the new libvirt ...

CWE-264 https://bugzilla.redhat.com/show_bug.cgi?id=607812 http://www.vupen.com/english/advisories/2010/2062 http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html http://libvirt.org/news.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html http://www.redhat.com/support/errata/RHSA-2010-0615.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://ubuntu.com/usn/usn-1008-2 http://ubuntu.com/usn/usn-1008-1 http://www.vupen.com/english/advisories/2010/2763 http://ubuntu.com/usn/usn-1008-3 https://access.redhat.com/errata/RHSA-2010:0615 https://nvd.nist.gov https://usn.ubuntu.com/1008-4/

CVE-2010-2239

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect