CVE-2013-4399

Name	CVE-2013-4399
Description	The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libvirt (PTS)	bullseye	7.0.0-3+deb11u3	fixed
	bookworm	9.0.0-4+deb12u1	fixed
	trixie	10.8.0-1	fixed
	sid	10.9.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
libvirt	source	squeeze	(not affected)
libvirt	source	wheezy	(not affected)
libvirt	source	(unstable)	1.1.4-1

[wheezy] - libvirt <not-affected> (Introduced in 1.1.0)
[squeeze] - libvirt <not-affected> (Introduced in 1.1.0)