openSUSE Security Update : libvirt (openSUSE-SU-2014:1290-1)

CVE-2014-3657: Fix domain deadlock fc22b2e7-CVE-2014-3657.patch bsc899484 - CVE-2014-3633: Use correct definition when looking up disk in qemu blkiotune 3e745e8f-CVE-2014-3633.patch bsc897783 - spec: libvirt-daemon package owns /etc/libvirt, not libvirt-client bnc878056 %NASLMINLEVEL 70300 C...

openSUSE Security Update : libvirt (openSUSE-SU-2014:1293-1)

CVE-2014-3657: Fix domain deadlock fc22b2e7-CVE-2014-3657.patch bsc899484 - CVE-2014-3633: Use correct definition when looking up disk in qemu blkiotune 3e745e8f-CVE-2014-3633.patch bsc897783 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Updated libvirt packages fix security vulnerbilities

Updated libvirt packages fix security vulnerabilities: An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune function looked up the disk index in a non-persistent live disk configuration while a persistent disk configuration was being indexed. A remote attacker able t...

MGASA-2014-0401 Updated libvirt packages fix security vulnerbilities

Updated libvirt packages fix security vulnerabilities: An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune function looked up the disk index in a non-persistent live disk configuration while a persistent disk configuration was being indexed. A remote attacker able t...

CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

DEBIAN-CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

DEBIAN-CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

Out-of-bounds

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

Command injection

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

CVE-2014-3657

CVE-2014-3657 affects libvirt; the virDomainListPopulate in conf/domain_conf.c does not clean up the lock on the domain list, allowing a remote attacker to cause a denial of service via a NULL in the second parameter of virConnectListAllDomains. The advisory text indicates this vulnerability exis...

CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...

CVE-2014-3657

The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service deadlock via a NULL value in the second parameter in the virConnectListAllDomains API command...