libguestfs, lua, ocaml, perl, python, ruby, virt security update

CentOS Errata and Security Advisory CESA-2016:2576

The libguestfs packages contain a library, which is used for accessing and modifying virtual machine (VM) disk images.

Virt-p2v is a tool for conversion of a physical server to a virtual guest.

The following packages have been upgraded to a newer upstream version: libguestfs (1.32.7), virt-p2v (1.32.7). (BZ#1218766)

Security Fix(es):

• An integer conversion flaw was found in the way OCaml’s String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. (CVE-2015-8869)

Note: The libguestfs packages in this advisory were rebuilt with a fixed version of OCaml to address this issue.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2016-November/029881.html

Affected packages:
libguestfs
libguestfs-bash-completion
libguestfs-devel
libguestfs-gfs2
libguestfs-gobject
libguestfs-gobject-devel
libguestfs-gobject-doc
libguestfs-inspect-icons
libguestfs-java
libguestfs-java-devel
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-man-pages-uk
libguestfs-rescue
libguestfs-rsync
libguestfs-tools
libguestfs-tools-c
libguestfs-xfs
lua-guestfs
ocaml-libguestfs
ocaml-libguestfs-devel
perl-Sys-Guestfs
python-libguestfs
ruby-libguestfs
virt-dib
virt-v2v

Upstream details at:
https://access.redhat.com/errata/RHSA-2016:2576