SUSE-SU-2017:2697-1 Security update for libvirt

This update for libvirt fixes several issues. This security issue was fixed: - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution These non-security issues were fixed: - bsc1049505, bsc1051017: Security manager: Don't...

PT-2017-19392

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description The issue allows for command execution by interpreting malicious hostname as arguments due to improper escaping of the ssh command line. Recommendations At the moment, there is no information...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2017:2660-1)

This update for libvirt fixes several issues. This security issue was fixed : - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution The update package also includes non-security fixes. See advisory for details. Note that Tenab...

SUSE-SU-2017:2660-1 Security update for libvirt

This update for libvirt fixes several issues. This security issue was fixed: - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution These non-security issues were fixed: - bsc1025340: Use xend for nodeGetFreeMemory API -...

openSUSE Security Update : libvirt (openSUSE-2017-1129)

This update for libvirt fixes several issues. This security issue was fixed : - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution These non-security issues were fixed : - bsc1049505, bsc1051017: Security manager: Don't...

PT-2017-19391

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description The issue allows for command execution by interpreting malicious hostname as arguments due to improper escaping of the ssh command line. Recommendations At the moment, there is no information...

PT-2017-4106

Name of the Vulnerable Software and Affected Versions libvirt versions 2.3.0 and later Description The issue is related to errors in the certificate authentication procedure in the Libvirt virtualization management library. Exploitation of this issue allows a remote attacker to access confidentia...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2598-1)

This update for libvirt fixes several issues. This security issue was fixed : - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution The update package also includes non-security fixes. See advisory for details. Note that Tenab...

SUSE-SU-2017:2598-1 Security update for libvirt

This update for libvirt fixes several issues. This security issue was fixed: - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution These non-security issues were fixed: - bsc1049505, bsc1051017: Security manager: Don't...

PT-2017-19389

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description The issue allows for command execution by interpreting malicious hostname as arguments due to improper escaping of the ssh command line. This can be exploited when a malicious hostname is...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

EulerOS 2.0 SP1 : libvirt (EulerOS-SA-2017-1053)

According to the version of the libvirt package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allow...

EulerOS 2.0 SP2 : libvirt (EulerOS-SA-2017-1052)

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it...

USN-3268-1: QEMU vulnerabilities

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. CVE-2016-10028 It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A privileged attacker...

PT-2018-7151

Name of the Vulnerable Software and Affected Versions: libvirt versions 2.5.0 through 3.0.0 Description: A NULL pointer deference flaw was found in the way libvirt handled empty drives. This issue could allow a remote authenticated attacker to crash the libvirtd daemon, resulting in a denial of...

CVE-2017-2635

A NULL pointer deference flaw was found in the way libvirt handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service...

PT-2021-7322

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description A flaw was found in the libvirt libxl driver, allowing a malicious guest to continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service...

Updated xen packages fix security vulnerability

This xen update is based on upstream 4.5.5 maintenance release, and fixes the following security issues: The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service host disk consumption by writing to stdout or stderr CVE-2014-3672 The xrstor...