<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2013-0010</id>

  <summary>Crash when querying domain memory stats</summary>

  <description>
<![CDATA[The code handling the virDomainMemoryStats API in the
libvirtd daemon dispatch did not correctly initialize variables
to NULL. Thus if RPC parameter validation failed it was possible
for libvirtd to access uninitialized memory during cleanup.]]>
  </description>

  <impact>
<![CDATA[A unprivileged user can cause libvirtd to access
uninitialized memory by sending an intentionally invalid
RPC request for domain memory stats. This could lead to
heap corruption in some cases]]>
  </impact>

  <workaround>
<![CDATA[Prevent untrusted users from connecting to the libvirtd
daemon or block access to the virDomainMemoryStats API with the
access control framework.]]>
  </workaround>

  <credits>
    <reporter>
      <name>Daniel Berrange</name>
      <email>berrange@redhat.com</email>
    </reporter>
    <patcher>
      <name>Daniel Berrange</name>
      <email>berrange@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20130903</reported>
    <published>20130918</published>
    <fixed>20130918</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2013-4296"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v0.9.1</tag>
      <tag state="vulnerable">v0.9.2</tag>
      <tag state="vulnerable">v0.9.3</tag>
      <tag state="vulnerable">v0.9.4</tag>
      <tag state="vulnerable">v0.9.5</tag>
      <tag state="vulnerable">v0.9.6</tag>
      <tag state="vulnerable">v0.9.7</tag>
      <tag state="vulnerable">v0.9.8</tag>
      <tag state="vulnerable">v0.9.9</tag>
      <tag state="vulnerable">v0.9.10</tag>
      <tag state="vulnerable">v0.9.11</tag>
      <tag state="vulnerable">v0.9.12</tag>
      <tag state="vulnerable">v0.9.13</tag>
      <tag state="vulnerable">v0.10.0</tag>
      <tag state="vulnerable">v0.10.1</tag>
      <tag state="vulnerable">v0.10.2</tag>
      <tag state="vulnerable">v1.0.0</tag>
      <tag state="vulnerable">v1.0.1</tag>
      <tag state="vulnerable">v1.0.2</tag>
      <tag state="vulnerable">v1.0.3</tag>
      <tag state="vulnerable">v1.0.4</tag>
      <tag state="vulnerable">v1.0.5</tag>
      <tag state="vulnerable">v1.0.6</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <tag state="fixed">v1.1.3</tag>
      <change state="fixed">e7f400a110e2e3673b96518170bfea0855dd82c0</change>
    </branch>
    <branch>
      <name>v0.9.6-maint</name>
      <tag state="vulnerable">v0.9.6.1</tag>
      <tag state="vulnerable">v0.9.6.2</tag>
      <tag state="vulnerable">v0.9.6.3</tag>
      <tag state="vulnerable">v0.9.6.4</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
    </branch>
    <branch>
      <name>v0.9.11-maint</name>
      <tag state="vulnerable">v0.9.11.1</tag>
      <tag state="vulnerable">v0.9.11.2</tag>
      <tag state="vulnerable">v0.9.11.3</tag>
      <tag state="vulnerable">v0.9.11.4</tag>
      <tag state="vulnerable">v0.9.11.5</tag>
      <tag state="vulnerable">v0.9.11.6</tag>
      <tag state="vulnerable">v0.9.11.7</tag>
      <tag state="vulnerable">v0.9.11.8</tag>
      <tag state="vulnerable">v0.9.11.9</tag>
      <tag state="vulnerable">v0.9.11.10</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
    </branch>
    <branch>
      <name>v0.9.12-maint</name>
      <tag state="vulnerable">v0.9.12.1</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <tag state="fixed">v0.9.12.2</tag>
      <change state="fixed">2f34eae93a09ac94297eaa91ad8f4b037b2c9e27</change>
    </branch>
    <branch>
      <name>v0.10.2-maint</name>
      <tag state="vulnerable">v0.10.2.1</tag>
      <tag state="vulnerable">v0.10.2.2</tag>
      <tag state="vulnerable">v0.10.2.3</tag>
      <tag state="vulnerable">v0.10.2.4</tag>
      <tag state="vulnerable">v0.10.2.5</tag>
      <tag state="vulnerable">v0.10.2.6</tag>
      <tag state="vulnerable">v0.10.2.7</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <tag state="fixed">v0.10.2.8</tag>
      <change state="fixed">455de1215cc921efcd2b210f129f55c27445d623</change>
    </branch>
    <branch>
      <name>v1.0.0-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
    </branch>
    <branch>
      <name>v1.0.1-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
    </branch>
    <branch>
      <name>v1.0.2-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">9579f4576c066bc20a8dd952b08657b326f71052</change>
    </branch>
    <branch>
      <name>v1.0.3-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">a413bc2dda06f47c2ec90ec924dbceb9dd0bbf97</change>
    </branch>
    <branch>
      <name>v1.0.4-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">95983486d9f882746e7e3c4ce621ecadd7466a40</change>
    </branch>
    <branch>
      <name>v1.0.5-maint</name>
      <tag state="vulnerable">v1.0.5.1</tag>
      <tag state="vulnerable">v1.0.5.2</tag>
      <tag state="vulnerable">v1.0.5.3</tag>
      <tag state="vulnerable">v1.0.5.4</tag>
      <tag state="vulnerable">v1.0.5.5</tag>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <tag state="fixed">v1.0.5.6</tag>
      <change state="fixed">118d26dc1fd99e0d113af364638be3e9a32f706e</change>
    </branch>
    <branch>
      <name>v1.0.6-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">6d1acf71955c0d02168217ad0a87ef8b779e0f89</change>
    </branch>
    <branch>
      <name>v1.1.0-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">2bfbf7a18e48127efd9b3d2d0976db6dffc476ff</change>
    </branch>
    <branch>
      <name>v1.1.1-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">f229972fd92374eed356c3ede74b886ebe77734e</change>
    </branch>
    <branch>
      <name>v1.1.2-maint</name>
      <change state="vulnerable">158ba8730e44b7dd07a21ab90499996c5dec080a</change>
      <change state="fixed">10d159fee27d007de42890626340c581cd12d788</change>
    </branch>
  </product>

</security-notice>
