Important: Red Hat Security Advisory: redhat-virtualization-host security and enhancement update

An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

EulerOS 2.0 SP5 : libvirt (EulerOS-SA-2019-1684)

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A NULL pointer dereference flaw was discovered in libvirt in the way it gets interface information through the QEMU agent. An attacker in a guest ...

openSUSE Security Update : libvirt (openSUSE-2019-1672)

This update for libvirt fixes the following issues : Security issues fixed : - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

openSUSE: Security Advisory for libvirt (openSUSE-SU-2019:1672-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1672-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

Security update for libvirt (important)

openSUSE Security Update: Security update for libvirt Announcement ID: openSUSE-SU-2019:1672-1 Rating: important References: 1136109 1138301 1138302 1138303 Cross-References: CVE-2019-10161 CVE-2019-10166 CVE-2019-10167 Affected Products: openSUSE Leap 15.0 An update that solves three...

CVE-2019-12928

QEMU's Machine Protocol QMP is designed to enable remote applications ex. Libvirt to control and manage QEMU process instances. It is meant to be used by trusted users and applications. The TCP server socket is only one of the transport options supported by QMP; other, more secure options, being...

EulerOS 2.0 SP8 : libvirt (EulerOS-SA-2019-1653)

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A NULL pointer dereference flaw was discovered in libvirt in the way it gets interface information through the QEMU agent. An attacker in a guest ...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:1686-1)

This update for libvirt fixes the following issues : Security issues fixed : CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

Debian DLA-1832-1 : libvirt security update

Two vulnerabilities were discovered in libvirt, an abstraction API for different underlying virtualisation mechanisms provided by the kernel, etc. - CVE-2019-10161: Prevent an vulnerability where readonly clients could use the API to specify an arbitrary path which would be accessed with the...

Debian: Security Advisory (DLA-1832-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:1690-1)

This update for libvirt fixes the following issue : Security issue fixed : CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd bsc113830...

Photon OS 1.0: Libvirt PHSA-2019-1.0-0237

An update of the libvirt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0237. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Virtuozzo 6 : libvirt / libvirt-client / libvirt-devel / etc (VZLSA-2019-1578)

An update for libvirt is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

[SECURITY] [DLA 1832-1] libvirt security update

Package : libvirt Version : 1.2.9-9+deb8u7 CVE IDs : CVE-2019-10161 CVE-2019-10167 Two vulnerabilities were discovered in libvirt, an abstraction API for different underlying virtualisation mechanisms provided by the kernel, etc. CVE-2019-10161: Prevent an vulnerability where readonly clients cou...

SUSE-SU-2019:1690-1 Security update for libvirt

This update for libvirt fixes the following issue: Security issue fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd bsc113830...

SUSE-SU-2019:1686-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

Arbitrary Code Execution

libvirt is vulnerable to arbitrary code execution. The virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU in libvirt APIs accept an "emulator" argument to specify the program providing emulation for a domain and libvirt will execute that program to probe the domain's capabilities...

Arbitrary Code Execution

libvirt is vulnerable to arbitrary code execution. The virConnectGetDomainCapabilities libvirt API accepts an emulatorbin argument to specify the program providing emulation for a domain. libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an...

Arbitrary Code Execution

libvirt is vulnerable to arbitrary code execution. It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local...