CVE-2012-3360: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2 and Essex 2012.1, when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. dot dot in the path attribute of a file element...

PT-2012-4662

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions 2012.1 through 2012.2 Description The issue allows remote authenticated users to write arbitrary files to the disk image via a .. dot dot in the path attribute of a file element, specifically in virt/disk/api.py...

PT-2012-6315

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions 2011.3 through 2012.2 Description The issue allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. This is due to a problem in the virt/disk/api.py file...

CVE-2012-3361: Undefined Security Weakness

virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image...

PT-2012-4663

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions 2011.3 through 2012.2 Description The issue allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. This is possible due to a flaw in the virt/disk/api.py modul...

RedHat Update for virt-v2v RHSA-2011:1615-03

Check for the Version of virt-v2v OpenVAS Vulnerability Test RedHat Update for virt-v2v RHSA-2011:1615-03 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

RedHat Update for virt-v2v RHSA-2011:1615-03

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

DEBIAN-CVE-2012-2690

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

CVE-2012-2690

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

CVE-2012-2690

CVE-2012-2690 affects libguestfs, where virt-edit fails to preserve source file permissions, saving edits with world-readable permissions. Local guest users could access sensitive data. The issue is addressed by updated libguestfs packages (e.g., >= 1.18.0 per RHSA-2012:0774 and related adviso...

CVE-2012-2690

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

CVE-2012-2690: Undefined Security Weakness

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

Oracle Linux 6 kernel security, bug fix and enhancement update

2.6.32-279.el6 - netdrv mlx4: ignore old module parameters Jay Fenlason 830553 2.6.32-278.el6 - kernel sysctl: silence warning about missing strategy for file-max at boot time Jeff Layton 803431 - net sunrpc: make new tcpmaxslottableentries sysctl use CTLUNNUMBERED Jeff Layton 803431 - drm i915:...

libguestfs security, bug fix, and enhancement update

1:1.16.19-1 - Rebase to libguestfs 1.16.19 resolves: rhbz719879 - Rebuild against augeas 0.9.0-3.el6 related: rhbz808662 - Fix: Don't abort inspection if mdadm.conf ARRAY doesn't have a uuid. - Switch back to git for patch management. 1:1.16.18-2 - Rebase to libguestfs 1.16.18 resolves: rhbz71987...

Low: Red Hat Security Advisory: libguestfs security, bug fix, and enhancement update

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, whic...

libguestfs: virt-edit creates a new file, when it is used leading to loss of file attributes (permissions, owner, SELinux context etc.)

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information...

PT-2012-4183

Name of the Vulnerable Software and Affected Versions libguestfs versions prior to 1.18.0 Description The issue allows local guest users to potentially obtain sensitive information due to the failure of virt-edit to preserve the original file permissions when editing, resulting in the new file...

kernel security and bug fix update

2.6.32-220.23.1.el6 - net bond: Make LRO flag follow slave settings Neil Horman 831176 794647 2.6.32-220.22.1.el6 - net ipv4/netfilter: TCP and raw fix for iproutemeharder Jiri Benc 824429 812108 2.6.32-220.21.1.el6 - security fix compile error in commoncap.c Eric Paris 806725 806726 CVE-2012-212...

kernel security and bug fix update

2.6.32-220.17.1.el6 - scsi fcoe: Do not switch context in vportdelete callback Neil Horman 809388 806119 2.6.32-220.16.1.el6 - Revert: x86 Ivy Bridge kernel rdrand support Jay Fenlason 800268 696442 2.6.32-220.15.1.el6 - net SUNRPC: We must not use listforeachentrysafe in rpcwakeup Steve Dickson...

SuSE 11.1 Security Update : Xen and libvirt (SAT Patch Number 5796)

This collective update 2012/02 for Xen provides fixes for the following reports : Xen : - 740165: Fix heap overflow in e1000 device emulation applicable to Xen qemu - CVE-2012-0029 - 739585: Xen block-attach fails after repeated attach/detach - 727515: Fragmented packets hang network boot of HVM...