{"id":"CVE-2015-5313","aliases":["DEBIAN-CVE-2015-5313","EUVD-2015-5284","GHSA-qr2q-8mvm-hxvr","MGASA-2016-0103","RHSA-2016:2577","SUSE-SU-2016:0304-1","SUSE-SU-2016:0923-1","SUSE-SU-2016:0931-1","UBUNTU-CVE-2015-5313","USN-2867-1","openSUSE-SU-2024:10209-1"],"status":"published","title":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage...","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","severity":{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00455,"percentile":0.39742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2015-12-18T00:00:00Z","modified":"2026-09-09T07:01:27Z","fixes":[{"ecosystem":"Debian:12","package":"libvirt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvirt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvirt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libvirt","fixed_in":["1.2.9.3-1.3.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libvirt","fixed_in":["1.2.18.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libvirt","fixed_in":["1.2.18.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libvirt","fixed_in":["1.2.18.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libvirt","fixed_in":["1.2.18.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libvirt","fixed_in":["1.2.18.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libvirt","fixed_in":["1.2.5-12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"libvirt","fixed_in":["1.2.5-12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libvirt","fixed_in":["1.2.5-12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libvirt","fixed_in":["1.2.5-12.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libvirt","fixed_in":["1.2.2-0ubuntu13.1.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9.3-1.3.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-login-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-config-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-config-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-interface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-nodedev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-secret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-driver-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvirt-daemon-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-config-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-config-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-interface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-nodedev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-secret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-driver-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-daemon-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-login-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvirt-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"libvirt-daemon-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"libvirt-login-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libvirt-daemon-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-login-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-config-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-config-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-interface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-nodedev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-secret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-daemon-driver-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvirt-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-lock-sanlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-login-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-config-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-config-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-interface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-nodedev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-nwfilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-secret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-driver-storage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-daemon-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvirt-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-10.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-27.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-12.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.16"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.16"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"redhat","product":"libvirt"}],"references":[{"url":"http://security.libvirt.org/2015/0004.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=034e47c338b13a95cf02106a3af912c1c5f818d7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/90913","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.redhat.com/archives/libvir-list/2015-December/msg00473.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174404.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2577.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5313","tags":["advisory"]},{"url":"http://libvirt.org/git/?p=libvirt.git;a=commit;h=034e47c338b13a95cf02106a3af912c1c5f818d7"},{"url":"https://access.redhat.com/errata/RHSA-2016:2577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277121","tags":["report"]},{"url":"https://github.com/advisories/GHSA-qr2q-8mvm-hxvr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5313","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17417","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-December/174404.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=846810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=868771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=921135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=986365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1002423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1004593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1004602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1025230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1055331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1097930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1134878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1139766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1151723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1159219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1197592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1220702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1227880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1231114","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1233003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1233115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1240439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1243684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1244128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1244567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1245476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1245525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1245647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1247521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1247987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1248277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1249441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1249981","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1250287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1250331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1251461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1253107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1256999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1257486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1261432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1263574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265114","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1266078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1266982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1267256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1269575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1269715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1270427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1270709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1270715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271069","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1272301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1273480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1273491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1273686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1275039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1276198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1283085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1285665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1286679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1288000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1288690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1289288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1289363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1289391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1290324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1293241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1293804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1293899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1294617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1299696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1302373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1306556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1312188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1314594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1315059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1318569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1318993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1319044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1322210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1325996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1341415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1341460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1342342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1342874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1342962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1343442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1344892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1350688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1350772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1351514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1354238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1356436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1356461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1356858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1356937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359071","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1361172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1361948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1363627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1363636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1363648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1363773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1368774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1370066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377212","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2577.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5160","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5313","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5008","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160304-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/899334","tags":["report"]},{"url":"https://bugzilla.suse.com/903757","tags":["report"]},{"url":"https://bugzilla.suse.com/904432","tags":["report"]},{"url":"https://bugzilla.suse.com/911737","tags":["report"]},{"url":"https://bugzilla.suse.com/914297","tags":["report"]},{"url":"https://bugzilla.suse.com/914693","tags":["report"]},{"url":"https://bugzilla.suse.com/921355","tags":["report"]},{"url":"https://bugzilla.suse.com/921555","tags":["report"]},{"url":"https://bugzilla.suse.com/921586","tags":["report"]},{"url":"https://bugzilla.suse.com/936524","tags":["report"]},{"url":"https://bugzilla.suse.com/938228","tags":["report"]},{"url":"https://bugzilla.suse.com/948516","tags":["report"]},{"url":"https://bugzilla.suse.com/948686","tags":["report"]},{"url":"https://bugzilla.suse.com/953110","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5313","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160923-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/952849","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/960305","tags":["report"]},{"url":"https://bugzilla.suse.com/964465","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160931-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/959094","tags":["report"]},{"url":"https://bugzilla.suse.com/961173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5313","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2867-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2011-4600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5247","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5247","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5313","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2016-04-11T21:00:00Z","modified":"2024-08-06T06:41:09.347Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5284","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2016-04-11T21:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-qr2q-8mvm-hxvr","title":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage...","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2022-05-14T03:59:06Z","modified":"2023-02-10T05:06:51Z","cvss":[{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:54:02.847747Z"}],"nvd":[{"id":"CVE-2015-5313","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2016-04-11T21:59:04.1Z","modified":"2026-06-17T00:28:54.683Z","cvss":[{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-5313","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2016-04-11T21:59:04Z","modified":"2026-04-16T06:16:22.888112545Z","cvss":[{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5313","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2016-04-11T21:59:04.1Z","modified":"2026-09-09T07:01:27.94259596Z","cvss":[{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"RHSA-2016:2577","title":"Red Hat Security Advisory: libvirt security, bug fix, and enhancement update","status":"published","published":"2024-09-13T11:06:00Z","modified":"2026-06-29T10:14:22Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2015-5313","description":"Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.","status":"published","published":"2015-12-18T00:00:00Z","modified":"2026-04-22T10:14:01.860526Z","cvss":[{"version":"3.0","score":2.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"MGASA-2016-0103","title":"Updated libvirt packages fix security vulnerability","description":"A path-traversal flaw was found in the way the libvirt daemon handled\nfile-system names for storage volumes. A libvirt user with privileges to\ncreate storage volumes and without privileges to create and modify domains\ncould possibly use this flaw to escalate their privileges (CVE-2015-5313).\n","status":"published","published":"2016-03-09T22:57:53Z","modified":"2026-04-16T06:24:07.989562779Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10209-1","title":"libvirt-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:02.434926Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:0304-1","title":"Security update for libvirt","description":"libvirt was updated to fix one security issue and several non-security issues.\n\nThis security issue was fixed:\n\n- CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC\n  password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot\n  to the virDomainSnapshotGetXMLDesc interface or (2) image to the\n  virDomainSaveImageGetXMLDesc interface. (bsc#914693)\n- CVE-2015-5313: path traversal vulnerability allowed libvirtd process to write arbitrary files into file system using root permissions (bsc#953110)\n\nTheses non-security issues were fixed:\n\n- bsc#948686: Use PAUSED state for domains that are starting up.\n- bsc#903757: Provide nodeGetSecurityModel implementation in libxl.\n- bsc#938228: Set disk type to BLOCK when driver is not tap or file.\n- bsc#948516: Fix profile_status to distinguish between errors and unconfined domains.\n- bsc#936524: Fix error starting lxc containers with direct interfaces.\n- bsc#921555: Fixed apparmor generated profile for PCI hostdevs.\n- bsc#899334: Include additional upstream fixes for systemd TerminateMachine.\n- bsc#921586: Fix security driver default settings in /etc/libvirt/qemu.conf.\n- bsc#921355: Fixed a number of QEMU apparmor abstraction problems.\n- bsc#911737: Additional fix for the case where security labels aren't automatically set.\n- bsc#914297: Allow setting the URL of an SMT server to use in place of SCC.\n- bsc#904432: Backported route definition changes.\n","status":"published","published":"2016-02-01T15:46:51Z","modified":"2026-02-04T03:14:20.313542Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0923-1","title":"Security update for libvirt","description":"\nThis update to libvirt 1.2.18.2 fixes the following minor security issue:\n\n- CVE-2015-5313: Directory traversal allowed privilege escalation (bsc#953110)\n\nThe following bugs were fixed:\n\n- bsc#952849: Don't add apparmor deny rw rule for 9P readonly mounts.\n- bsc#960305: libxl: support parsing and formatting vif bandwidth\n- bsc#954872: libxl: Add support for block-{dmmd,drbd,npiv} scripts\n- bsc#964465: Remove 'Wants=xencommons.service' from libvirtd service file\n","status":"published","published":"2016-03-31T12:19:00Z","modified":"2026-02-04T03:52:31.678996Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0931-1","title":"Security update for libvirt","description":"\nThis update for libvirt fixes the following issues:\n\nSecurity issue:\n- CVE-2015-5313: directory directory traversal privilege\n  escalation vulnerability. (bsc#953110)\n\nBugs fixed:\n- bsc#960305: xenxs: support parsing and formatting vif bandwidth\n- bsc#961173: xen: use correct domctl version in domaininfolist union\n- bsc#959094: xen: Disable building xen-inotify subdriver. It is unmaintained\n  and contains bugs that can cause client connection failures.\n- bsc#948686: qemu: Use PAUSED state for domains that are starting up\n- bsc#948516: Fix profile_status to distringuish between errors and unconfined\n  domains.\n","status":"published","published":"2016-04-01T08:28:33Z","modified":"2026-02-04T03:03:56.409104Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2867-1","title":"libvirt vulnerabilities","description":"It was discovered that libvirt incorrectly handled the firewall rules on\nbridge networks when the daemon was restarted. This could result in an\nunintended firewall configuration. This issue only applied to Ubuntu 12.04\nLTS. (CVE-2011-4600)\n\nPeter Krempa discovered that libvirt incorrectly handled locking when\ncertain ACL checks failed. A local attacker could use this issue to cause\nlibvirt to stop responding, resulting in a denial of service. This issue\nonly applied to Ubuntu 14.04 LTS. (CVE-2014-8136)\n\nLuyao Huang discovered that libvirt incorrectly handled VNC passwords in\nshapshot and image files. A remote authenticated user could use this issue\nto possibly obtain VNC passwords. This issue only affected Ubuntu 14.04\nLTS. (CVE-2015-0236)\n\nHan Han discovered that libvirt incorrectly handled volume creation\nfailure when used with NFS. A remote authenticated user could use this\nissue to cause libvirt to crash, resulting in a denial of service. This\nissue only applied to Ubuntu 15.10. (CVE-2015-5247)\n\nOssi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly\nperformed storage pool name validation. A remote authenticated user could\nuse this issue to bypass ACLs and gain access to unintended files. This\nissue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10.\n(CVE-2015-5313)\n","status":"published","published":"2016-01-12T18:06:25Z","modified":"2026-04-22T09:20:26.697451Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}