NVD

Id
32926  
Name
CVE-2014-5177  
Description
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.  
Reject
 
CVSS Version
2  
CVSS Score
1.2  
Severity
Low  
CVSS Base Score
1.2  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-08-03  
Modified Date
2014-12-23  
Seq
2014-5177  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
172928 32926 CVE-2014-5177 http://libvirt.org/news.html  View
172929 32926 CVE-2014-5177 openSUSE-SU-2014:0650  View
172930 32926 CVE-2014-5177 openSUSE-SU-2014:0674  View
172931 32926 CVE-2014-5177 RHSA-2014:0560  View
172932 32926 CVE-2014-5177 GLSA-201412-04  View
172933 32926 CVE-2014-5177 http://security.libvirt.org/2014/0003.html  View
172934 32926 CVE-2014-5177 USN-2366-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14799 JVNDB-2014-003674 libvirt における任意のファイルを読まれる脆弱性 libvirt には、ファイングレインアクセス制御が有効になっている場合、任意のファイルを読まれる脆弱性が存在します。 CVE-2014-5177 72466 CVE-2014-5177 32926 1.2 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003674.html 2014-05-06 2014-08-05 View