CVE-2014-5177 (GCVE-0-2014-5177)

Vulnerability from cvelistv5 – Published: 2014-08-03 18:00 – Updated: 2024-08-06 11:34
VLAI?
Summary
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://rhn.redhat.com/errata/RHSA-2014-0560.html vendor-advisoryx_refsource_REDHAT
http://libvirt.org/news.html x_refsource_CONFIRM
http://secunia.com/advisories/60895 third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-201412-04.xml vendor-advisoryx_refsource_GENTOO
http://lists.opensuse.org/opensuse-updates/2014-0… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-0… vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2366-1 vendor-advisoryx_refsource_UBUNTU
http://security.libvirt.org/2014/0003.html x_refsource_CONFIRM
Date Public ?
2014-05-06 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:34:37.613Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2014:0560",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://libvirt.org/news.html"
          },
          {
            "name": "60895",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60895"
          },
          {
            "name": "GLSA-201412-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"
          },
          {
            "name": "openSUSE-SU-2014:0674",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"
          },
          {
            "name": "openSUSE-SU-2014:0650",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"
          },
          {
            "name": "USN-2366-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2366-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security.libvirt.org/2014/0003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-05-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-12T13:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2014:0560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://libvirt.org/news.html"
        },
        {
          "name": "60895",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60895"
        },
        {
          "name": "GLSA-201412-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"
        },
        {
          "name": "openSUSE-SU-2014:0674",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"
        },
        {
          "name": "openSUSE-SU-2014:0650",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"
        },
        {
          "name": "USN-2366-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2366-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security.libvirt.org/2014/0003.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5177",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2014:0560",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0560.html"
            },
            {
              "name": "http://libvirt.org/news.html",
              "refsource": "CONFIRM",
              "url": "http://libvirt.org/news.html"
            },
            {
              "name": "60895",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60895"
            },
            {
              "name": "GLSA-201412-04",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201412-04.xml"
            },
            {
              "name": "openSUSE-SU-2014:0674",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html"
            },
            {
              "name": "openSUSE-SU-2014:0650",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html"
            },
            {
              "name": "USN-2366-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2366-1"
            },
            {
              "name": "http://security.libvirt.org/2014/0003.html",
              "refsource": "CONFIRM",
              "url": "http://security.libvirt.org/2014/0003.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-5177",
    "datePublished": "2014-08-03T18:00:00.000Z",
    "dateReserved": "2014-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:34:37.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-5177",
      "date": "2026-05-23",
      "epss": "0.00114",
      "percentile": "0.29588"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"105130E9-D48E-4FB8-A715-E6438EC7E744\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DFBF430B-0832-44B0-AA0E-BA9E467F7668\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A10BC294-9196-425F-9FB0-B1625465B47F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E13A6AAE-BC1B-4CE1-B747-84F9C6B3FF73\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6DDA1805-ED8A-44AA-96FF-E676D278CCFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBD82EEA-279F-42CA-8F4C-A4D57EEBAB0D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"320C2182-DBCF-4564-940A-D12673C73543\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB635DBE-29F1-4055-A064-42539FC811C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"67B77F63-C9AC-42D4-B9E2-4BBE196AC254\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3256288E-5A49-4DCD-AE30-6B4E21AEF970\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"25E764AE-3B7C-4378-97C5-10E835511684\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F982F65C-CBF9-4EE6-8FD6-C965141E42C9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4BF8152-79A4-48C6-88EB-9D3FA7466844\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.5.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A9E4DCDE-4D85-4339-99CB-70A464FA2EE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E03AF346-6F4E-4BEA-B29E-9C9C04148843\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"54FAE380-0E7E-4468-A07B-5A9A3504F681\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB4B1021-4D01-4D86-AED4-0418F8839FD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"380686BB-7212-4285-BA00-B8EEAC6E1CC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7A331072-326A-4E72-84E2-E0424E6DDE30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CB1666DD-AC49-477A-921C-8197F5EFECA6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"527B9236-CA4E-42A8-8C7A-2FB92BE2B4B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA9572AC-1D6D-4AA1-AEF0-CB9143F38215\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D6B6D6F-6CD3-43C3-B1EC-18DEC89DFDA6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF21D58D-6952-4C72-94C3-32421499AFCE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:libvirt:1.2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83403472-4883-4914-846A-3C3E912C5573\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.\"}, {\"lang\": \"es\", \"value\": \"libvirt 1.0.0 hasta 1.2.x anterior a 1.2.5, cuando el control de acceso detallado est\\u00e1 habilitado, permite a usuarios locales leer ficheros arbitrarios a trav\\u00e9s de un documento XML manipulado que contiene una declaraci\\u00f3n de entidad externa XML en conjunto con una referencia de entidad en el m\\u00e9todo API (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU o (19) virConnectBaselineCPU, relacionado con un problema de entidad externa XML (XXE). NOTA: este problema ha sido dividido (SPLIT) del CVE-2014-0179 por ADT3 debido a las diferentes versiones afectadas de algunos vectores.\"}]",
      "id": "CVE-2014-5177",
      "lastModified": "2024-11-21T02:11:33.197",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:H/Au:N/C:P/I:N/A:N\", \"baseScore\": 1.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"HIGH\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 1.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-08-03T18:55:05.693",
      "references": "[{\"url\": \"http://libvirt.org/news.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0560.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/60895\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://security.gentoo.org/glsa/glsa-201412-04.xml\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://security.libvirt.org/2014/0003.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-2366-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://libvirt.org/news.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0560.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/60895\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://security.gentoo.org/glsa/glsa-201412-04.xml\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://security.libvirt.org/2014/0003.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-2366-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-5177\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-08-03T18:55:05.693\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.\"},{\"lang\":\"es\",\"value\":\"libvirt 1.0.0 hasta 1.2.x anterior a 1.2.5, cuando el control de acceso detallado est\u00e1 habilitado, permite a usuarios locales leer ficheros arbitrarios a trav\u00e9s de un documento XML manipulado que contiene una declaraci\u00f3n de entidad externa XML en conjunto con una referencia de entidad en el m\u00e9todo API (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU o (19) virConnectBaselineCPU, relacionado con un problema de entidad externa XML (XXE). NOTA: este problema ha sido dividido (SPLIT) del CVE-2014-0179 por ADT3 debido a las diferentes versiones afectadas de algunos vectores.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:P/I:N/A:N\",\"baseScore\":1.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"105130E9-D48E-4FB8-A715-E6438EC7E744\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFBF430B-0832-44B0-AA0E-BA9E467F7668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A10BC294-9196-425F-9FB0-B1625465B47F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E13A6AAE-BC1B-4CE1-B747-84F9C6B3FF73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DDA1805-ED8A-44AA-96FF-E676D278CCFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBD82EEA-279F-42CA-8F4C-A4D57EEBAB0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"320C2182-DBCF-4564-940A-D12673C73543\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB635DBE-29F1-4055-A064-42539FC811C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67B77F63-C9AC-42D4-B9E2-4BBE196AC254\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3256288E-5A49-4DCD-AE30-6B4E21AEF970\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25E764AE-3B7C-4378-97C5-10E835511684\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F982F65C-CBF9-4EE6-8FD6-C965141E42C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4BF8152-79A4-48C6-88EB-9D3FA7466844\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9E4DCDE-4D85-4339-99CB-70A464FA2EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E03AF346-6F4E-4BEA-B29E-9C9C04148843\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54FAE380-0E7E-4468-A07B-5A9A3504F681\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB4B1021-4D01-4D86-AED4-0418F8839FD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"380686BB-7212-4285-BA00-B8EEAC6E1CC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A331072-326A-4E72-84E2-E0424E6DDE30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB1666DD-AC49-477A-921C-8197F5EFECA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"527B9236-CA4E-42A8-8C7A-2FB92BE2B4B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA9572AC-1D6D-4AA1-AEF0-CB9143F38215\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D6B6D6F-6CD3-43C3-B1EC-18DEC89DFDA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF21D58D-6952-4C72-94C3-32421499AFCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:libvirt:1.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83403472-4883-4914-846A-3C3E912C5573\"}]}]}],\"references\":[{\"url\":\"http://libvirt.org/news.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0560.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/60895\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201412-04.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.libvirt.org/2014/0003.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2366-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://libvirt.org/news.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0560.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/60895\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201412-04.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.libvirt.org/2014/0003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2366-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.