<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2025-0002</id>

  <summary>External inactive snapshot of a VM results in world-readable disk images</summary>

  <description>
<![CDATA[External inactive snapshots are created by invoking 'qemu-img' which
         creates the file. Currently qemu-img creates image with mode 644 based
         on default umask as libvirt doesn't set any.]]>
  </description>

  <impact>
<![CDATA[Newly created disk images are world-readable. Malicious user on the host
         can read newly written data in the VM.]]>
  </impact>

  <workaround>
<![CDATA[Don't create snapshots while the VM is inactive or fix the
         permissions after creating the snapshot.]]>
  </workaround>

  <credits>
    <reporter>
      <name>Sylvain Beucler</name>
      <email>beuc@beuc.net</email>
    </reporter>
    <patcher>
      <name>Peter Krempa</name>
      <email>pkrempa@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20251105</reported>
    <published>20251113</published>
    <fixed>20251113</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2025-13193"/>
    <bug tracker="debian" id="1120119"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v1.0.1</tag>
      <tag state="vulnerable">v1.0.2</tag>
      <tag state="vulnerable">v1.0.3</tag>
      <tag state="vulnerable">v1.0.4</tag>
      <tag state="vulnerable">v1.0.5</tag>
      <tag state="vulnerable">v1.0.6</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <tag state="vulnerable">v1.1.3</tag>
      <tag state="vulnerable">v1.1.4</tag>
      <tag state="vulnerable">v1.2.0</tag>
      <tag state="vulnerable">v1.2.1</tag>
      <tag state="vulnerable">v1.2.2</tag>
      <tag state="vulnerable">v1.2.3</tag>
      <tag state="vulnerable">v1.2.4</tag>
      <tag state="vulnerable">v1.2.5</tag>
      <tag state="vulnerable">v1.2.6</tag>
      <tag state="vulnerable">v1.2.7</tag>
      <tag state="vulnerable">v1.2.8</tag>
      <tag state="vulnerable">v1.2.9</tag>
      <tag state="vulnerable">v1.2.10</tag>
      <tag state="vulnerable">v1.2.11</tag>
      <tag state="vulnerable">v1.2.12</tag>
      <tag state="vulnerable">v1.2.13</tag>
      <tag state="vulnerable">v1.2.14</tag>
      <tag state="vulnerable">v1.2.15</tag>
      <tag state="vulnerable">v1.2.16</tag>
      <tag state="vulnerable">v1.2.17</tag>
      <tag state="vulnerable">v1.2.18</tag>
      <tag state="vulnerable">v1.2.19</tag>
      <tag state="vulnerable">v1.2.20</tag>
      <tag state="vulnerable">v1.2.21</tag>
      <tag state="vulnerable">v1.3.0</tag>
      <tag state="vulnerable">v1.3.1</tag>
      <tag state="vulnerable">v1.3.2</tag>
      <tag state="vulnerable">v1.3.3</tag>
      <tag state="vulnerable">v1.3.4</tag>
      <tag state="vulnerable">v1.3.5</tag>
      <tag state="vulnerable">v2.0.0</tag>
      <tag state="vulnerable">v2.1.0</tag>
      <tag state="vulnerable">v2.2.0</tag>
      <tag state="vulnerable">v2.3.0</tag>
      <tag state="vulnerable">v2.4.0</tag>
      <tag state="vulnerable">v2.5.0</tag>
      <tag state="vulnerable">v3.0.0</tag>
      <tag state="vulnerable">v3.1.0</tag>
      <tag state="vulnerable">v3.2.0</tag>
      <tag state="vulnerable">v3.3.0</tag>
      <tag state="vulnerable">v3.4.0</tag>
      <tag state="vulnerable">v3.5.0</tag>
      <tag state="vulnerable">v3.6.0</tag>
      <tag state="vulnerable">v3.7.0</tag>
      <tag state="vulnerable">v3.8.0</tag>
      <tag state="vulnerable">v3.9.0</tag>
      <tag state="vulnerable">v3.10.0</tag>
      <tag state="vulnerable">v4.0.0</tag>
      <tag state="vulnerable">v4.1.0</tag>
      <tag state="vulnerable">v4.2.0</tag>
      <tag state="vulnerable">v4.3.0</tag>
      <tag state="vulnerable">v4.4.0</tag>
      <tag state="vulnerable">v4.5.0</tag>
      <tag state="vulnerable">v4.6.0</tag>
      <tag state="vulnerable">v4.7.0</tag>
      <tag state="vulnerable">v4.8.0</tag>
      <tag state="vulnerable">v4.9.0</tag>
      <tag state="vulnerable">v4.10.0</tag>
      <tag state="vulnerable">v5.0.0</tag>
      <tag state="vulnerable">v5.1.0</tag>
      <tag state="vulnerable">v5.2.0</tag>
      <tag state="vulnerable">v5.3.0</tag>
      <tag state="vulnerable">v5.4.0</tag>
      <tag state="vulnerable">v5.5.0</tag>
      <tag state="vulnerable">v5.6.0</tag>
      <tag state="vulnerable">v5.7.0</tag>
      <tag state="vulnerable">v5.8.0</tag>
      <tag state="vulnerable">v5.9.0</tag>
      <tag state="vulnerable">v5.10.0</tag>
      <tag state="vulnerable">v6.0.0</tag>
      <tag state="vulnerable">v6.1.0</tag>
      <tag state="vulnerable">v6.2.0</tag>
      <tag state="vulnerable">v6.3.0</tag>
      <tag state="vulnerable">v6.4.0</tag>
      <tag state="vulnerable">v6.5.0</tag>
      <tag state="vulnerable">v6.6.0</tag>
      <tag state="vulnerable">v6.7.0</tag>
      <tag state="vulnerable">v6.8.0</tag>
      <tag state="vulnerable">v6.9.0</tag>
      <tag state="vulnerable">v6.10.0</tag>
      <tag state="vulnerable">v7.0.0</tag>
      <tag state="vulnerable">v7.1.0</tag>
      <tag state="vulnerable">v7.2.0</tag>
      <tag state="vulnerable">v7.3.0</tag>
      <tag state="vulnerable">v7.4.0</tag>
      <tag state="vulnerable">v7.5.0</tag>
      <tag state="vulnerable">v7.6.0</tag>
      <tag state="vulnerable">v7.7.0</tag>
      <tag state="vulnerable">v7.8.0</tag>
      <tag state="vulnerable">v7.9.0</tag>
      <tag state="vulnerable">v7.10.0</tag>
      <tag state="vulnerable">v8.0.0</tag>
      <tag state="vulnerable">v8.1.0</tag>
      <tag state="vulnerable">v8.2.0</tag>
      <tag state="vulnerable">v8.3.0</tag>
      <tag state="vulnerable">v8.4.0</tag>
      <tag state="vulnerable">v8.5.0</tag>
      <tag state="vulnerable">v8.6.0</tag>
      <tag state="vulnerable">v8.7.0</tag>
      <tag state="vulnerable">v8.8.0</tag>
      <tag state="vulnerable">v8.9.0</tag>
      <tag state="vulnerable">v8.10.0</tag>
      <tag state="vulnerable">v9.0.0</tag>
      <tag state="vulnerable">v9.1.0</tag>
      <tag state="vulnerable">v9.2.0</tag>
      <tag state="vulnerable">v9.3.0</tag>
      <tag state="vulnerable">v9.4.0</tag>
      <tag state="vulnerable">v9.5.0</tag>
      <tag state="vulnerable">v9.6.0</tag>
      <tag state="vulnerable">v9.7.0</tag>
      <tag state="vulnerable">v9.8.0</tag>
      <tag state="vulnerable">v9.9.0</tag>
      <tag state="vulnerable">v9.10.0</tag>
      <tag state="vulnerable">v10.0.0</tag>
      <tag state="vulnerable">v10.1.0</tag>
      <tag state="vulnerable">v10.2.0</tag>
      <tag state="vulnerable">v10.3.0</tag>
      <tag state="vulnerable">v10.4.0</tag>
      <tag state="vulnerable">v10.5.0</tag>
      <tag state="vulnerable">v10.6.0</tag>
      <tag state="vulnerable">v10.7.0</tag>
      <tag state="vulnerable">v10.8.0</tag>
      <tag state="vulnerable">v10.9.0</tag>
      <tag state="vulnerable">v10.10.0</tag>
      <tag state="vulnerable">v11.0.0</tag>
      <tag state="vulnerable">v11.1.0</tag>
      <tag state="vulnerable">v11.2.0</tag>
      <tag state="vulnerable">v11.3.0</tag>
      <tag state="vulnerable">v11.4.0</tag>
      <tag state="vulnerable">v11.5.0</tag>
      <tag state="vulnerable">v11.6.0</tag>
      <tag state="vulnerable">v11.7.0</tag>
      <tag state="vulnerable">v11.8.0</tag>
      <tag state="vulnerable">v11.9.0</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
      <tag state="fixed">v11.10.0</tag>
      <change state="fixed">a379327d8abcde8ac8d3e16fe5e4ba6f790d767a</change>
    </branch>
    <branch>
      <name>v1.0.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.0.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.0.3-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.0.4-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.0.5-maint</name>
      <tag state="vulnerable">v1.0.5.1</tag>
      <tag state="vulnerable">v1.0.5.2</tag>
      <tag state="vulnerable">v1.0.5.3</tag>
      <tag state="vulnerable">v1.0.5.4</tag>
      <tag state="vulnerable">v1.0.5.5</tag>
      <tag state="vulnerable">v1.0.5.6</tag>
      <tag state="vulnerable">v1.0.5.7</tag>
      <tag state="vulnerable">v1.0.5.8</tag>
      <tag state="vulnerable">v1.0.5.9</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.0.6-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.1.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.1.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.1.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.1.3-maint</name>
      <tag state="vulnerable">v1.1.3.1</tag>
      <tag state="vulnerable">v1.1.3.2</tag>
      <tag state="vulnerable">v1.1.3.3</tag>
      <tag state="vulnerable">v1.1.3.4</tag>
      <tag state="vulnerable">v1.1.3.5</tag>
      <tag state="vulnerable">v1.1.3.6</tag>
      <tag state="vulnerable">v1.1.3.7</tag>
      <tag state="vulnerable">v1.1.3.8</tag>
      <tag state="vulnerable">v1.1.3.9</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.1.4-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.3-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.4-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.5-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.6-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.7-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.8-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.9-maint</name>
      <tag state="vulnerable">v1.2.9.1</tag>
      <tag state="vulnerable">v1.2.9.2</tag>
      <tag state="vulnerable">v1.2.9.3</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.10-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.11-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.12-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.13-maint</name>
      <tag state="vulnerable">v1.2.13.1</tag>
      <tag state="vulnerable">v1.2.13.2</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.14-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.15-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.16-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.17-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.18-maint</name>
      <tag state="vulnerable">v1.2.18.1</tag>
      <tag state="vulnerable">v1.2.18.2</tag>
      <tag state="vulnerable">v1.2.18.3</tag>
      <tag state="vulnerable">v1.2.18.4</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.19-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.20-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.2.21-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.3-maint</name>
      <tag state="vulnerable">v1.3.3.1</tag>
      <tag state="vulnerable">v1.3.3.2</tag>
      <tag state="vulnerable">v1.3.3.3</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.4-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v1.3.5-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v2.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v2.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v2.2-maint</name>
      <tag state="vulnerable">v2.2.1</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v3.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v3.2-maint</name>
      <tag state="vulnerable">v3.2.1</tag>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v3.7-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.3-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.4-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.5-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.6-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.7-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.8-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.9-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v4.10-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v5.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v5.1-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v5.1.0-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v5.2-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
    <branch>
      <name>v5.3-maint</name>
      <change state="vulnerable">9b5a514b31f0a092cff5402e37d06d1c31f1b992</change>
    </branch>
  </product>

</security-notice>
