Lucene search

K
mageiaGentoo FoundationMGASA-2014-0243
HistoryMay 29, 2014 - 11:01 a.m.

Updated libvirt packages fix multiple vulnerabilities

2014-05-2911:01:13
Gentoo Foundation
advisories.mageia.org
10

5.8 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:A/AC:M/Au:S/C:N/I:P/A:C

0.001 Low

EPSS

Percentile

27.0%

Updated libvirt packages fix security vulnerabilities: The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456). libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchlibvirt< 1.0.2-8.5libvirt-1.0.2-8.5.mga3
Mageia4noarchlibvirt< 1.2.1-1.1libvirt-1.2.1-1.1.mga4

5.8 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:A/AC:M/Au:S/C:N/I:P/A:C

0.001 Low

EPSS

Percentile

27.0%