CVE

Id
60117  
CVE No.
CVE-2013-0170  
Status
Candidate  
Description
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.  
Phase
Assigned (20121206)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
606940 60117 CVE-2013-0170 CONFIRM:http://libvirt.org/git/?p=libvirt.git;a=commit;h=46532e3e8ed5f5a736a02f67d6c805492f9ca720  View
606941 60117 CVE-2013-0170 CONFIRM:http://libvirt.org/news.html  View
606942 60117 CVE-2013-0170 CONFIRM:http://wiki.libvirt.org/page/Maintenance_Releases  View
606943 60117 CVE-2013-0170 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=893450  View
606944 60117 CVE-2013-0170 FEDORA:FEDORA-2013-1626  View
606945 60117 CVE-2013-0170 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098398.html  View
606946 60117 CVE-2013-0170 FEDORA:FEDORA-2013-1642  View
606947 60117 CVE-2013-0170 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098370.html  View
606948 60117 CVE-2013-0170 FEDORA:FEDORA-2013-1644  View
606949 60117 CVE-2013-0170 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098326.html  View
606950 60117 CVE-2013-0170 REDHAT:RHSA-2013:0199  View
606951 60117 CVE-2013-0170 URL:http://rhn.redhat.com/errata/RHSA-2013-0199.html  View
606952 60117 CVE-2013-0170 SUSE:SUSE-SU-2013:0320  View
606953 60117 CVE-2013-0170 URL:http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00016.html  View
606954 60117 CVE-2013-0170 SUSE:openSUSE-SU-2013:0274  View
606955 60117 CVE-2013-0170 URL:http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00001.html  View
606956 60117 CVE-2013-0170 SUSE:openSUSE-SU-2013:0275  View
606957 60117 CVE-2013-0170 URL:http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00002.html  View
606958 60117 CVE-2013-0170 UBUNTU:USN-1708-1  View
606959 60117 CVE-2013-0170 URL:http://www.ubuntu.com/usn/USN-1708-1  View
606960 60117 CVE-2013-0170 BID:57578  View
606961 60117 CVE-2013-0170 URL:http://www.securityfocus.com/bid/57578  View
606962 60117 CVE-2013-0170 OSVDB:89644  View
606963 60117 CVE-2013-0170 URL:http://osvdb.org/89644  View
606964 60117 CVE-2013-0170 SECTRACK:1028047  View
606965 60117 CVE-2013-0170 URL:http://www.securitytracker.com/id/1028047  View
606966 60117 CVE-2013-0170 SECUNIA:52001  View
606967 60117 CVE-2013-0170 URL:http://secunia.com/advisories/52001  View
606968 60117 CVE-2013-0170 SECUNIA:52003  View
606969 60117 CVE-2013-0170 URL:http://secunia.com/advisories/52003  View
606970 60117 CVE-2013-0170 XF:libvirt-virnetmessagefree-code-exec(81552)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
20906 JVNDB-2013-002481 Grape などの製品で使用される Ruby 用 multi_xml gem におけるオブジェクトインジェクション攻撃を誘発される脆弱性 Grape およびその他の製品で使用される Ruby 用 multi_xml gem は、文字列の値のキャストを適切に制限しないため、オブジェクトインジェクション攻撃を誘発される、および任意のコードを実行される、またはサービス運用妨害 (メモリおよび CPU 資源の消費) 状態にされる脆弱性が存在します。 CVE-2013-0175 60117 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002481.html  View