Bug 485520 (CVE-2013-4296)

Summary:	<app-emulation/libvirt-1.1.2-r3: unprivileged DoS on system service (CVE-2013-4296)
Product:	Gentoo Security	Reporter:	Doug Goldstein (RETIRED) <cardoe>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B1 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	484488
Bug Blocks:

Description Doug Goldstein (RETIRED) gentoo-dev

2013-09-20 21:32:21 UTC

<app-emulation/libvirt-1.1.2-r2: unprivileged DoS on system service (CVE-2013-4296)

Comment 1 Chris Reffett (RETIRED) gentoo-dev

2013-09-25 18:01:12 UTC

CC arches when ready.

Comment 2 Doug Goldstein (RETIRED) gentoo-dev

2013-09-25 20:38:21 UTC

This isn't really related to bug #485328 since it has nothing to do with polkit. Bug the tracker for CVE-2013-4311 has the arches CC'd for stabilization.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2013-10-02 04:04:10 UTC

CVE-2013-4296 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4296):
  The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt
  0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and
  1.1.x before 1.1.2 allows remote authenticated users to cause a denial of
  service (uninitialized pointer dereference and crash) via a crafted RPC
  call.

Comment 4 Sergey Popov gentoo-dev

2013-10-02 09:16:22 UTC

Added to existing GLSA draft

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2014-12-08 23:47:46 UTC

This issue was resolved and addressed in
 GLSA 201412-04 at http://security.gentoo.org/glsa/glsa-201412-04.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).