libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libvirtUpgrade libvirt-docsUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-pythonUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-networkUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemonUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-secretUpgrade libvirt-devel | Dec 1, 2016 | Aug 3, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Aug 3, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Aug 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 6, 2014 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Nov 8, 2024 | Aug 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub