libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Aug 30, 2017 | Apr 15, 2014 |
| Centos_linux | — | Upgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-docsUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-develUpgrade libvirt-daemon-kvmUpgrade libvirtUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-clientUpgrade libvirt-login-shellUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-network | Dec 1, 2016 | Aug 3, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Aug 3, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Aug 3, 2014 |
| Oracle_linux | — | Upgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-docsUpgrade libvirt-daemon-driver-networkUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-login-shellUpgrade libvirt-pythonUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-interface | Oct 16, 2024 | Aug 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 6, 2014 |
| Suse | — | Upgrade libvirt-docUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirtUpgrade libvirt-daemon-qemuUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-adminUpgrade libvirt-daemon-lxcUpgrade libvirt-devel-32bitUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-clientUpgrade libvirt-daemonUpgrade libvirt-develUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-client-32bitUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-network | Dec 18, 2015 | Jun 12, 2014 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Nov 8, 2024 | Aug 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub