CVE-2012-3445

Publication date 7 August 2012

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer.

Read the notes from the security team

Status

Package Ubuntu Release Status
libvirt 12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.04 LTS lucid
Not affected
8.04 LTS hardy Ignored end of life

Notes

mdeslaur

precise and earlier don't have virTypedParameterArrayClear, so no invalid free possible.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libvirt