Description
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 1.2.4-1 | — |
| Debian 13 | libvirt | 1.2.4-1 | — |
| Debian 12 | libvirt | 1.2.4-1 | — |
| Debian 7 | libvirt | 0.9.12.3-1+deb7u1 | DSA-3038-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libvirt | 1.2.2-0ubuntu13.1.5 | USN-2366-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libvirt +19 | 1.1.1-29.el7_0.1 | RHSA-2014:0914 |
| RHEL 6 | libvirt +4 | 0.10.2-29.el6_5.8 | RHSA-2014:0560 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libvirt | 2.5.0-1.1 | openSUSE-SU-2024:10209-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libvirt +19 | 1.1.1-29.0.1.el7_0.1 | ELSA-2014-0914 |
Advisories 6
- RHSA-2014:0914 Red Hat Security Advisory: libvirt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0560 Red Hat Security Advisory: libvirt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-2366-1 libvirt vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3038-1 libvirt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10209-1 libvirt-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-0914 Moderate: libvirt security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- RHSA-2014:0560 vendor-advisory
- http://libvirt.org/news.html
- 60895 third-party-advisory
- GLSA-201412-04 vendor-advisory
- openSUSE-SU-2014:0674 vendor-advisory
- DSA-3038 vendor-advisory
- openSUSE-SU-2014:0650 vendor-advisory
- USN-2366-1 vendor-advisory
- http://security.libvirt.org/2014/0003.html