PT-2010-3835 · Red Hat · Libvirt

Published 2010-08-19 · Updated 2010-10-30 · CVE-2010-2238

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat libvirt versions 0.7.2 through 0.8.2

Description The issue allows guest OS users to potentially read arbitrary files on the host OS and may have other unspecified impacts. This is due to the software recursing into disk-image backing stores without properly extracting the defined disk backing-store format.

Recommendations For versions 0.7.2 through 0.8.2, update to a version that properly handles disk-image backing stores to prevent unauthorized access to host OS files.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2238

Affected Products

Libvirt

References · 13

• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2238 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2238 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2238 · Vendor Advisory
• http://ubuntu.com/usn/usn-1008-3 · Vendor Advisory
• http://ubuntu.com/usn/usn-1008-1 · Vendor Advisory
• http://libvirt.org/news.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2238 · Security Note
• http://ubuntu.com/usn/usn-1008-2 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/2763 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=607811 · Note