PublicDateAtUSN: 2014-08-03
Candidate: CVE-2014-5177
PublicDate: 2014-08-03 18:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5177
 http://security.libvirt.org/2014/0003.html
 http://rhn.redhat.com/errata/RHSA-2014-0560.html
 http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html
 http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html
 http://libvirt.org/news.html
 https://ubuntu.com/security/notices/USN-2366-1
Description:
 libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control
 is enabled, allows local users to read arbitrary files via a crafted XML
 document containing an XML external entity declaration in conjunction with
 an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML,
 (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5)
 virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7)
 virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML,
 (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12)
 virConnectDomainXMLToNative, (13) virSecretDefineXML, (14)
 virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16)
 virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18)
 virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to
 an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from
 CVE-2014-0179 per ADT3 due to different affected versions of some vectors.
Ubuntu-Description:
Notes:
 mdeslaur> non-default configuration
 mdeslaur> same fix as CVE-2014-0179
Bugs:
Priority: low
Discovered-by: Daniel P. Berrange and Richard Jones
Assigned-to: mdeslaur
CVSS: 

Patches_libvirt:
upstream_libvirt: released (1.2.4-1)
lucid_libvirt: not-affected
precise_libvirt: not-affected (0.9.8-2ubuntu17.19)
trusty_libvirt: released (1.2.2-0ubuntu13.1.5)
trusty/esm_libvirt: released (1.2.2-0ubuntu13.1.5)
devel_libvirt: not-affected (1.2.6-0ubuntu2)