Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 386287 (CVE-2011-2178)

Summary: <app-emulation/libvirt-0.9.2: information leak (CVE-2011-2178)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: cardoe, virtualization
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2011-10-08 13:30:53 UTC
CVE-2011-2178 (
  The virSecurityManagerGetPrivateData function in security/security_manager.c
  in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call,
  which causes incorrect processing of "security manager private data" that
  "reopens disk probing" and might allow guest OS users to read arbitrary
  files on the host OS.  NOTE: this vulnerability exists because of a
  CVE-2010-2238 regression.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2011-10-09 12:35:48 UTC
Added to pending GLSA request.
Comment 2 Doug Goldstein (RETIRED) gentoo-dev 2012-02-09 19:28:45 UTC
Versions affected are no longer in tree.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2012-02-27 22:33:01 UTC
This issue was resolved and addressed in
 GLSA 201202-07 at
by GLSA coordinator Stefan Behte (craig).