Scientific Linux Security Update : libvirt on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: libvirt 2.0.0. Security Fixes : - It was found that the libvirt daemon, when using RBD RADOS Block Device, leaked private credentials to the process list. A local attacker could use this flaw to perform certain privileged...

GLSA-201612-10 : libvirt: Directory traversal

The remote host is affected by the vulnerability described in GLSA-201612-10 libvirt: Directory traversal Normally, only privileged users can coerce libvirt into creating or opening existing files using the virStorageVol APIs; and such users already have full privilege to create any domain XML. B...

libvirt: Directory traversal

Background libvirt is a C toolkit for manipulating virtual machines. Description Normally, only privileged users can coerce libvirt into creating or opening existing files using the virStorageVol APIs; and such users already have full privilege to create any domain XML. But in the case of...

CentOS 7 : libvirt (CESA-2016:2577)

An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

libvirt security update

CentOS Errata and Security Advisory CESA-2016:2577 An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

delimiter injection vulnerabilities in pygrub

ISSUE DESCRIPTION pygrub, the boot loader emulator, fails to quote or sanity check its results when reporting them to its caller. pygrub supports a number of output formats. When the S-expression output format is requested, putting string quotes and S-expressions in the bootloader configuration...

Ubuntu: Security Advisory (USN-3125-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : libvirt (ELSA-2016-2577)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2577 advisory. 2.0.0-10 - virtlogd: Don't stop or restart along with libvirtd rhbz1372576 2.0.0-9 - Add helper for removing transient definition rhbz1368774 - qemu:...

USN-3125-1: QEMU vulnerabilities

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. CVE-2016-5403 Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network card...

RHEL 7 : libvirt (RHSA-2016:2577)

An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RedHat Update for libvirt RHSA-2016:2577-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: libvirt security, bug fix, and enhancement update

An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

libvirt: Ceph id/key leaked in the process list

It was found that the libvirt daemon, when using RBD RADOS Block Device, leaked private credentials to the process list. A local attacker could use this flaw to perform certain privileged operations within the cluster...

libvirt: filesystem storage volume names path traversal flaw

A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges...

libvirt: Setting empty VNC password allows access to unauthorized users

It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required. An attacker could use this flaw to access a VNC server with an empty VNC password without any authenticatio...

PT-2018-4396

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 2.2 Description The issue allows local users to obtain sensitive information, specifically Ceph credentials, via a process listing when using RADOS Block Device RBD because the credentials are included on the qemu...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:2053-1)

This update for libvirt fixes one security issue : - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes : - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2016:1944-1)

This update for libvirt fixes the following issues: Security issues fixed : - CVE-2016-5008: empty VNC password disables authentication bsc987527 Bugs fixed : - bsc970906: Fixed a race condition in xenstore event handling. - bsc952889: Change hap setting to align with Xen behavior. - Fixed 'make...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU regression (USN-3047-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3047-2 advisory. USN-3047-1 fixed vulnerabilities in QEMU. The patch to fix CVE-2016-5403 caused a regression which resulted in save/restore failures when virtio memor...

SUSE-SU-2016:2053-1 Security update for libvirt

This update for libvirt fixes one security issue: - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes: - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...