CVE-2015-5313

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description The issue allows local users with storage vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name, when fine-grained Access Control Lists (ACL) are in effect. This is due to a directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage backend fs.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.