CVE-2015-0236: Canonical Ubuntu Linux

Low severity, CVSS 3.5. EPSS: 1.8% chance of exploitation in the next 30 days.

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
• Mageia Mageia: version 4.0 only
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Hpc Node: version 7.0 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• Red Hat Libvirt: up to and including 1.2.11; version 1.2.0 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.4 only; …

Published 2015-01-29. Last modified 2026-06-17.