UBUNTU-CVE-2020-10703

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools li...

Denial Of Service (DoS)

libvirt is vulnerable to denial of service DoS. The vulnerability exists as an integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus with specially-crafted parameters,...

Denial Of Service (DoS)

libvirt is vulnerable to denial of service. A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd...

Privilege Escalation

libvirt is vulnerable to privilege escalation. The vulnerability exists as it was found that several libvirt API calls did not honor the read-only permission for connections. A local attacker able to establish a read-only connection to libvirtd on a server could use this flaw to execute commands...

Information Disclosure

libvirt is vulnerable to information disclosure. It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read...

Information Disclosure

libvirt is vulnerable to information disclosure. It was found that libvirt created insecure iptables rules on the host when a guest system was configured for IP masquerading, allowing the guest to use privileged ports on the host when accessing network resources. A privileged guest user could use...

Arbitrary Code Execution

libvirt is vulnerable to arbitrary code execution. The vulnerability exists as libvirtproxy, a setuid helper application allowing non-privileged users to communicate with the hypervisor, was discovered to not properly validate user requests. Local users could use this flaw to cause a stack-based...

Privilege Escalation

libvirt is vulnerable to privilege escalation. The vulnerability exists as the libvirtd daemon was discovered to not properly check user connection permissions before performing certain privileged actions, such as requesting migration of an unprivileged guest domain to another system. A local use...

Important Photon OS Security Update - PHSA-2020-0228

Updates of 'httpd', 'file', 'libvirt' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0228

An update of 'libvirt', 'httpd', 'file' packages of Photon OS has been released...

Important Photon OS Security Update - PHSA-2020-0078

Updates of 'bubblewrap', 'python3', 'python2', 'haproxy', 'yarn', 'ansible', 'libtiff', 'libvirt' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-3.0-0078

Updates of 'libtiff', 'haproxy', 'yarn', 'libvirt', 'ansible', 'python3', 'bubblewrap', 'python2' packages of Photon OS have been released...

CVE-2020-10703

A NULL pointer dereference was found in the libvirt API responsible for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection...

CVE-2020-10701

A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this...

CVE-2019-12929

QEMU's Machine Protocol QMP is designed to enable remote applications ex. Libvirt to control and manage QEMU process instances. QEMU Guest-Agent is a daemon program which helps remote applications ex. Libvirt to run commands on the guest VM, it supports QMP commands. It is meant to be used by...

PT-2020-6733 · Libvirt +4 · Libvirt +4

Name of the Vulnerable Software and Affected Versions: libvirt versions 4.10.0 through 6.0 Description: The issue is related to a memory leak in the virDomainListGetStats libvirt API, which is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged...

PT-2020-6393

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 6.2.0 Description A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for th...

CVE-2019-20485

qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service API blockage...

CVE-2019-20485

qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service API blockage...

DEBIAN-CVE-2019-20485

qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service API blockage...