{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-05-06T00:00:00", "descriptions": [{"lang": "en", "value": "libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-12-12T13:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "RHSA-2014:0560", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://libvirt.org/news.html"}, {"name": "60895", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/60895"}, {"name": "GLSA-201412-04", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"}, {"name": "openSUSE-SU-2014:0674", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"}, {"name": "openSUSE-SU-2014:0650", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"}, {"name": "USN-2366-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2366-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://security.libvirt.org/2014/0003.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-5177", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "RHSA-2014:0560", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"}, {"name": "http://libvirt.org/news.html", "refsource": "CONFIRM", "url": "http://libvirt.org/news.html"}, {"name": "60895", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/60895"}, {"name": "GLSA-201412-04", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"}, {"name": "openSUSE-SU-2014:0674", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"}, {"name": "openSUSE-SU-2014:0650", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"}, {"name": "USN-2366-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2366-1"}, {"name": "http://security.libvirt.org/2014/0003.html", "refsource": "CONFIRM", "url": "http://security.libvirt.org/2014/0003.html"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-5177", "datePublished": "2014-08-03T18:00:00", "dateReserved": "2014-08-03T00:00:00", "dateUpdated": "2014-12-12T13:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "105130E9-D48E-4FB8-A715-E6438EC7E744", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:libvirt:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E13A6AAE-BC1B-4CE1-B747-84F9C6B3FF73", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "6DDA1805-ED8A-44AA-96FF-E676D278CCFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "BBD82EEA-279F-42CA-8F4C-A4D57EEBAB0D", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "320C2182-DBCF-4564-940A-D12673C73543", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "EB635DBE-29F1-4055-A064-42539FC811C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "67B77F63-C9AC-42D4-B9E2-4BBE196AC254", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "3256288E-5A49-4DCD-AE30-6B4E21AEF970", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "25E764AE-3B7C-4378-97C5-10E835511684", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "F982F65C-CBF9-4EE6-8FD6-C965141E42C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "F4BF8152-79A4-48C6-88EB-9D3FA7466844", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.6:*:*:*:*:*:*:*", "matchCriteriaId": "A9E4DCDE-4D85-4339-99CB-70A464FA2EE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "E03AF346-6F4E-4BEA-B29E-9C9C04148843", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "54FAE380-0E7E-4468-A07B-5A9A3504F681", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "FB4B1021-4D01-4D86-AED4-0418F8839FD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "380686BB-7212-4285-BA00-B8EEAC6E1CC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "7A331072-326A-4E72-84E2-E0424E6DDE30", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "CB1666DD-AC49-477A-921C-8197F5EFECA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "527B9236-CA4E-42A8-8C7A-2FB92BE2B4B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "FA9572AC-1D6D-4AA1-AEF0-CB9143F38215", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "3D6B6D6F-6CD3-43C3-B1EC-18DEC89DFDA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "BF21D58D-6952-4C72-94C3-32421499AFCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:libvirt:1.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "83403472-4883-4914-846A-3C3E912C5573", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors."}, {"lang": "es", "value": "libvirt 1.0.0 hasta 1.2.x anterior a 1.2.5, cuando el control de acceso detallado est\u00e1 habilitado, permite a usuarios locales leer ficheros arbitrarios a trav\u00e9s de un documento XML manipulado que contiene una declaraci\u00f3n de entidad externa XML en conjunto con una referencia de entidad en el m\u00e9todo API (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU o (19) virConnectBaselineCPU, relacionado con un problema de entidad externa XML (XXE). NOTA: este problema ha sido dividido (SPLIT) del CVE-2014-0179 por ADT3 debido a las diferentes versiones afectadas de algunos vectores."}], "id": "CVE-2014-5177", "lastModified": "2019-04-22T17:48:00.643", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.2, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 1.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-08-03T18:55:05.693", "references": [{"source": "cve@mitre.org", "url": "http://libvirt.org/news.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/60895"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://security.libvirt.org/2014/0003.html"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2366-1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}