Login Request a demo
Unscored severity · published Aug 6, 2014
CVE-2014-3559
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Enterprise Virtualization · Redhat
3.4 · source: NVD
Affected product
EV
Enterprise Virtualization
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3559
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1002.html
www.securitytracker.com
http://www.securitytracker.com/id/1030664
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1121925
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/95098
More from Enterprise Virtualization
9.8
CVE-2018-1117
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently…
9.8
CVE-2013-1591
Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors
7.5
CVE-2015-5201
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise…
7.5
CVE-2018-1111
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP…
7.2
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to…