CVE-2014-0179: Input Validation
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0179?
CVE-2014-0179 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2014-0179?
To fix CVE-2014-0179, update libvirt to version 1.2.5 or later.
Who is affected by CVE-2014-0179?
CVE-2014-0179 affects local users of libvirt versions 0.7.5 through 1.2.x prior to 1.2.5.
What issues does CVE-2014-0179 cause?
CVE-2014-0179 allows local users to cause a denial of service by blocking reads and hanging the process.
What types of XML documents are involved in CVE-2014-0179?
CVE-2014-0179 involves crafted XML documents that contain XML external entity declarations.