CVE-2016-5008 PUBLISHED

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

EPSS 2.12% · 84.0th percentile

Risk Scores

EPSS Score
2.12%
84.0th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlibvirt0, 1.2.16-2ubuntu11, 1.2.16-2ubuntu12
Ubuntu:14.04:LTSlibvirt1.2.2-0ubuntu13.1.4, 1.2.2-0ubuntu13.1.5, 1.2.2-0ubuntu13.1.6

Timeline

References

Open in Interactive Console →