CVE-2014-3559
Last modified
CVE-2014-3559 is a vulnerability of currently unknown severity. The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.. EPSS estimates a 1.44% chance of exploitation in the next 30 days.
Description
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Virtualization | 3.4 |
References
- http://rhn.redhat.com/errata/RHSA-2014-1002.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1002.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-3559?
How severe is CVE-2014-3559?
How do I fix CVE-2014-3559?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-3553mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.…
- CVE-2014-3554Buffer overflow in the ndp_msg_opt_dnssl_domain function in …
- CVE-2014-3555OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, a…
- CVE-2014-3556The STARTTLS implementation in mail/ngx_mail_smtp_handler.c …
- CVE-2014-3557Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-3558ReflectionHelper (org.hibernate.validator.util.ReflectionHel…
- CVE-2014-3560NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.…
- CVE-2014-3561The rhevm-log-collector package in Red Hat Enterprise Virtua…
- CVE-2014-3562Red Hat Directory Server 8 and 389 Directory Server, when de…
- CVE-2014-3563Multiple unspecified vulnerabilities in Salt (aka SaltStack)…
- CVE-2014-3564Multiple heap-based buffer overflows in the status_handler f…
- CVE-2014-3565snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ op…
Are you affected by CVE-2014-3559?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST