CVE-2013-0170: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 5.8% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 12.10 only
• Fedoraproject Fedora: version 16 only; version 17 only; version 18 only
• Opensuse Opensuse: version 12.1 only; version 12.2 only
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Eus: version 6.3 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Workstation: version 6.0 only
• Red Hat Libvirt: from 0.9.6, before 0.9.6.4 (fixed in 0.9.6.4); from 0.9.11, before 0.9.11.9 (fixed in 0.9.11.9); from 0.10.2, before 0.10.2.3 (fixed in 0.10.2.3); from 1.0.0, before 1.0.2 (fixed in 1.0.2)
• Suse Linux Enterprise Desktop: version 11 only
• Suse Linux Enterprise Server: version 11 only
• Suse Linux Enterprise Software Development Kit: version 11 only

Published 2013-02-08. Last modified 2026-06-16.