CVE-2018-1064

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
libvirt	libvirt	before 4.2.0-rc1

References

https://access.redhat.com/errata/RHSA-2018:1396
https://access.redhat.com/errata/RHSA-2018:1929
https://bugzilla.redhat.com/show_bug.cgi?id=1550672Issue Tracking, Patch, Third Party Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
https://lists.debian.org/debian-lts-announce/2018/03/msg00018.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3680-1/
https://www.debian.org/security/2018/dsa-4137Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1396
https://access.redhat.com/errata/RHSA-2018:1929
https://bugzilla.redhat.com/show_bug.cgi?id=1550672Issue Tracking, Patch, Third Party Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
https://lists.debian.org/debian-lts-announce/2018/03/msg00018.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3680-1/
https://www.debian.org/security/2018/dsa-4137Third Party Advisory

Timeline

Published: Mar 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-106418.1D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.CVE-2018-106427.2Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing t CVE-2018-106457.8Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This ser CVE-2018-106467.8CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. This service es CVE-2018-106477.8SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service CVE-2018-106489.8There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.CVE-2018-106496.1There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.CVE-2018-10654.7The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined CVE-2018-106507.8There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.CVE-2018-106516.1There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.CVE-2018-106527.5There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.CVE-2018-106539.8There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.