SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:0923-1)

This update to libvirt 1.2.18.2 fixes the following minor security issue : - CVE-2015-5313: Directory traversal allowed privilege escalation bsc953110 The following bugs were fixed : - bsc952849: Don't add apparmor deny rw rule for 9P readonly mounts. - bsc960305: libxl: support parsing and...

Mageia: Security Advisory (MGASA-2016-0103)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0103 Updated libvirt packages fix security vulnerability

A path-traversal flaw was found in the way the libvirt daemon handled file-system names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges CVE-2015-5313...

Fedora 23 : libvirt-1.2.18.2-1.fc23 (2015-30b347dff1)

Rebased to version 1.2.18.2 disk backend is not removed properly when disk frontent hotplug fails bz 1265968 Fix TPM cancel path on newer kernels bz 1244895 Remove timeout for libvirt-guests.service bz 1195544 CVE-2015-5313 libvirt: filesystem storage volume names path traversal flaw bz 1291433...

Fedora 22 : libvirt-1.2.13.2-1.fc22 (2015-2c9678da8c)

Rebased to version 1.2.13.2 disk backend is not removed properly when disk frontent hotplug fails bz 1265968 Fix TPM cancel path on newer kernels bz 1244895 Remove timeout for libvirt-guests.service bz 1195544 CVE-2015-5313 libvirt: filesystem storage volume names path traversal flaw bz 1291433...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:0304-1)

libvirt was updated to fix one security issue and several non-security issues. This security issue was fixed : - CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC password by using the VIRDOMAINXMLSECURE flag with a crafted 1 snapshot to the virDomainSnapshotGetXMLDesc...

openSUSE Security Update : libvirt (openSUSE-2016-77)

This update for libvirt fixes the following issues : - CVE-2015-5313: directory directory traversal privilege escalation vulnerability. boo953110 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Updat...

F5 Networks BIG-IP : Linux kernel vulnerabilities (K62700573)

CVE-2010-5313 Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service L1 guest OS crash via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842. CVE-2014-7842 Race condition in...

SOL62700573 - Linux kernel vulnerabilities CVE-2010-5313 and CVE-2014-7842

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Ubuntu: Security Advisory (USN-2867-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : libvirt vulnerabilities (USN-2867-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2867-1 advisory. It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintende...

Unbreakable Enterprise kernel security update

2.6.39-400.264.13 - KEYS: Don't permit requestkey to construct a new keyring David Howells Orabug: 22373449 CVE-2015-7872 2.6.39-400.264.12 - crypto: add missing crypto module aliases Mathias Krause Orabug: 22249656 CVE-2013-7421 CVE-2014-9644 - crypto: include crypto- module prefix in template...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20151119)

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their...

Security fix for the ALT Linux 8 package libvirt version 1.3.0-alt1

Dec. 18, 2015 Alexey Shabalin 1.3.0-alt1 - 1.3.0 - fixed CVE-2015-5313...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2015:2152 Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 7. This is the second...

RedHat Update for kernel RHSA-2015:2152-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES11 Security Update : kernel (SUSE-SU-2015:0652-1)

The SUSE Linux Enterprise 11 Service Pack 1 LTSS kernel was updated to fix security issues on kernels on the x8664 architecture. The following security bugs have been fixed : - CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allowed...

Symantec Web Gateway OS Command Injection (CVE-2014-7285; CVE-2016-5313)

A remote command execution vulnerability has been reported in Symantec Web Gateway. The vulnerability is due to improper input validation. A remote attacker can exploit this issue by sending a malicious HTTP request containing a specially crafted parameter to the target server...

CVE-2011-5313

CVE-2011-5313 affects Redaxscript 0.3.2, with multiple SQL injection vulnerabilities in includes/password.php that allow remote attackers to execute arbitrary SQL commands via the id or password parameter to the password_reset program. Exploitation details and patch information are not provided i...

CVE-2010-5313

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service L1 guest OS crash via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842...