libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade ocaml-libguestfsUpgrade libguestfs-mountUpgrade libguestfs-javadocUpgrade libguestfsUpgrade perl-Sys-GuestfsUpgrade libguestfs-toolsUpgrade ocaml-libguestfs-develUpgrade libguestfs-tools-cUpgrade ruby-libguestfsUpgrade guestfishUpgrade libguestfs-javaUpgrade python-libguestfsUpgrade libguestfs-develUpgrade libguestfs-java-devel | Oct 16, 2024 | Nov 4, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub