Every CVE Search/ Get API key

CVE-2011-1146

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read...

6.9 MediumFix available

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Exploit likelihood

1.65%Down 6.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.9

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
CVE-2011-1146
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
CVE-2011-1146
Updated
2026-11-02
EUVDEUVD-2011-1160 No score

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
EUVD-2011-1160
Updated
2026-11-03
GitHub AdvisoriesGHSA-69mw-4jhr-4j3r No score

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read...

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
GHSA-69mw-4jhr-4j3r
Updated
2026-11-02
OSV No score

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
CVE-2011-1146
Updated
2026-11-02
OSVDEBIAN-CVE-2011-1146 No score

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Record
DEBIAN-CVE-2011-1146
Updated
2026-11-02
OSVopenSUSE-SU-2024:10209-1 No score

libvirt-2.5.0-1.1 on GA media

These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10209-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libvirt
Debian:12
 before 0.8.8-3
0.8.8-3
libvirt
Debian:13
 before 0.8.8-3
0.8.8-3
libvirt
Debian:14
 before 0.8.8-3
0.8.8-3
libvirt
Debian:6.0
 before 0.8.3-5+squeeze1, plus listed versions
0.8.3-50.8.3-5+squeeze00.8.3-5+squeeze1~bpo50+1
0.8.3-5+squeeze1
libvirt
Red Hat:rhel_virtualization:5::server
 before 0:0.8.2-15.el5_6.3
0:0.8.2-15.el5_6.3
libvirt-debuginfo
Red Hat:rhel_virtualization:5::server
 before 0:0.8.2-15.el5_6.3
0:0.8.2-15.el5_6.3
libvirt-devel
Red Hat:rhel_virtualization:5::server
 before 0:0.8.2-15.el5_6.3
0:0.8.2-15.el5_6.3
libvirt-python
Red Hat:rhel_virtualization:5::server
 before 0:0.8.2-15.el5_6.3
0:0.8.2-15.el5_6.3
libvirt
Red Hat:enterprise_linux:6::client
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
Show 19 moreShow less
Affected packages
PackageAffectedFixed
libvirt-devel
Red Hat:enterprise_linux:6::client
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-client
Red Hat:enterprise_linux:6::client
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-python
Red Hat:enterprise_linux:6::client
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt
Red Hat:enterprise_linux:6::computenode
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-devel
Red Hat:enterprise_linux:6::computenode
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-client
Red Hat:enterprise_linux:6::computenode
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-python
Red Hat:enterprise_linux:6::computenode
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt
Red Hat:enterprise_linux:6::server
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-client
Red Hat:enterprise_linux:6::server
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-devel
Red Hat:enterprise_linux:6::server
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-python
Red Hat:enterprise_linux:6::server
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt
Red Hat:enterprise_linux:6::workstation
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-client
Red Hat:enterprise_linux:6::workstation
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-devel
Red Hat:enterprise_linux:6::workstation
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt-python
Red Hat:enterprise_linux:6::workstation
 before 0:0.8.1-27.el6_0.5
0:0.8.1-27.el6_0.5
libvirt
openSUSE:Tumbleweed
 before 2.5.0-1.1
2.5.0-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1146 is a medium vulnerability (CVSS 6.9) in Redhat Libvirt, published March 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in libvirt 0.8.8-3.

References

Show 58 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open