OESA-2024-1391 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: An off-by-one error flaw was found in the udevListInterfacesByStatus function in...

The vulnerability of the virStoragePoolObjListSearch function in the virtualization management library Libvirt allows a attacker to trigger a service failure.

The vulnerability of the virStoragePoolObjListSearch function in the Libvirt management library arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

The vulnerability of the virPCIVirtualFunctionList function in the virtualization management library Libvirt allows a attacker to trigger a service failure.

The vulnerability of the virPCIVirtualFunctionList function in the virtualization management library Libvirt is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the udevListInterfacesByStatus() function in the libvirt library, which allows a hacker to trigger a service failure

The vulnerability of the udevListInterfacesByStatus function in the src/interface/interfacebackendudev.c module of the libvirt library is related to an off-by-one error. Exploiting this vulnerability could allow an attacker to trigger a service failure...

ROS-20240410-03

A vulnerability in the Libvirt virtualization management library is related to insufficient blocking. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

virt:kvm_utils3 security update

hivex libguestfs libguestfs-winsupport 8.9-1 - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE-2022-40284 - resolves: rhbz2236372 libiscsi libnbd libtpms libvirt 9.0.0-5 - Fix off-by-one error in udevListInterfacesByStatus Martin Kletzander Orabug: 36364464 CVE-2024-1441 libvirt-dbus libvirt-python...

CVE-2024-1441 affecting package libvirt for versions less than 7.10.0-8

CVE-2024-1441 affecting package libvirt for versions less than 7.10.0-8. A patched version of the package is available...

SUSE SLED15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2024:1099-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1099-1 advisory. - CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential...

openSUSE: Security Advisory for libvirt (SUSE-SU-2024:1100-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2024:1100-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1100-1 advisory. - CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential DoS. bsc1221815 Tenable has extracted the...

Mageia: Security Advisory (MGASA-2024-0114)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated libvirt packages fix security vulnerability

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being...

MGASA-2024-0114 Updated libvirt packages fix security vulnerability

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being...

SUSE-SU-2024:1100-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential DoS. bsc1221815 The following non-security bug was fixed: - Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap bsc1221749...

SUSE-SU-2024:1099-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential DoS. bsc1221815 - CVE-2024-2496: Fixed NULL pointer dereference in udevConnectListAllInterfaces bsc1221468. - CVE-2024-1441: Fix off-by-one error in...

Fedora: Security Advisory (FEDORA-2024-ebf015aa4e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: libvirt / libvirt-admin / libvirt-client / libvirt-daemon / etc (SUSE-SU-2024:1083-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1083-1 advisory. - CVE-2024-2494: Fixed negative gnew0 length leading to unbounded memory allocation bsc1221815. Tenable has extracted the preceding...

NULL Pointer Dereference

Libvirt is vulnerable to NULL pointer dereference. The vulnerability is caused by a race condition due to the simultaneous detachment of a host interface while collecting the list of interfaces using the virConnectListAllInterfaces API. This race condition leads to a situation where the path...

SUSE-SU-2024:1083-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2024-2494: Fixed negative gnew0 length leading to unbounded memory allocation bsc1221815...

Denial Of Service (DoS)

Libvirt is vulnerable to Denial of ServiceDoS. The vulnerability is due to improper handling of negative array lengths during memory allocation. If an attacker can pass a negative length to the gnew0 function will usually result in a Denial of ServiceDoS...