openSUSE Security Update : libvirt (openSUSE-SU-2014:0593-1)

libvirt was updated to fix various bugs and security issues : CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration CVE-2013-6456: unsafe usage of paths under /proc/$PID/root Bugfixes for libvirt client killed on reboot shutdown. bnc852005 Also notify systemd when we...

Ubuntu Update for libvirt USN-2209-1

Check for the Version of libvirt OpenVAS Vulnerability Test $Id: gbubuntuUSN22091.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for libvirt USN-2209-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Ubuntu 13.10 : libvirt vulnerabilities (USN-2209-1)

It was discovered that libvirt incorrectly handled symlinks when using the LXC driver. An attacker could possibly use this issue to delete host devices, create arbitrary nodes, and shutdown or power off the host. CVE-2013-6456 Marian Krcmarik discovered that libvirt incorrectly handled seamless...

USN-2209-1: libvirt vulnerabilities

It was discovered that libvirt incorrectly handled symlinks when using the LXC driver. An attacker could possibly use this issue to delete host devices, create arbitrary nodes, and shutdown or power off the host. CVE-2013-6456 Marian Krcmarik discovered that libvirt incorrectly handled seamless...

CVE-2013-7336

The qemuMigrationWaitForSpice function in qemu/qemumigration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service NULL pointer dereference and libvirtd crash by causing domblkstat to be called a...

DEBIAN-CVE-2013-7336

The qemuMigrationWaitForSpice function in qemu/qemumigration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service NULL pointer dereference and libvirtd crash by causing domblkstat to be called a...

Null pointer dereference

The qemuMigrationWaitForSpice function in qemu/qemumigration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service NULL pointer dereference and libvirtd crash by causing domblkstat to be called a...

CVE-2013-7336

CVE-2013-7336 affects libvirt in qemu migration flow. The qemuMigrationWaitForSpice function in qemu/qemu_migration.c fails to properly enter a monitor during seamless SPICE migration, enabling a local user to trigger a NULL pointer dereference and libvirtd crash by racing with qemuMonitorGetSpic...

UBUNTU-CVE-2013-7336

The qemuMigrationWaitForSpice function in qemu/qemumigration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service NULL pointer dereference and libvirtd crash by causing domblkstat to be called a...

Important: Red Hat Security Advisory: rhevm-spice-client security update

Updated rhevm-spice-client packages that fix multiple security issues are now available for Red Hat Enterprise Virtualization Manager 3. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2013-6434

The remote-viewer in Red Hat Enterprise Virtualization Manager RHEV-M before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server...

Code injection

The remote-viewer in Red Hat Enterprise Virtualization Manager RHEV-M before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server...

CVE-2013-6434

The remote-viewer in Red Hat Enterprise Virtualization Manager RHEV-M before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server...

CVE-2013-6434

The CVE-2013-6434 issue affects Red Hat Enterprise Virtualization Manager (RHEV‑M) versions prior to 3.3, where the remote-viewer using a native SPICE client invocation initially makes insecure connections to the SPICE server. The underlying cause is how RHEV‑M relays SPICE connection information...

CVE-2013-6434

The remote-viewer in Red Hat Enterprise Virtualization Manager RHEV-M before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server...

PT-2014-3112 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager RHEV-M versions prior to 3.3 Description: The issue allows man-in-the-middle attackers to spoof the SPICE server due to the remote-viewer initially making insecure connections to the SPICE server when...

Mandriva Linux Security Advisory : spice (MDVSA-2014:016)

Updated spice packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way the redshandleticket function in the spice-server library handled decryption of ticket data provided by the client. A remote user able to initiate a SPICE connection to an application actin...

CVE-2013-2152

Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization RHEV 3.2, allows local users to gain privileges via a crafted application in an unspecified folder...

Design/Logic Flaw

Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization RHEV 3.2, allows local users to gain privileges via a crafted application in an unspecified folder...

CVE-2013-2152

Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization RHEV 3.2, allows local users to gain privileges via a crafted application in an unspecified folder...