MGASA-2019-0390
- Source
- https://advisories.mageia.org/MGASA-2019-0390.html
- Import Source
- https://advisories.mageia.org/MGASA-2019-0390.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2019-0390
- Related
- Published
- 2019-12-15T18:03:05Z
- Modified
- 2019-12-15T17:42:09Z
- Summary
- Updated libvirt packages fix security vulnerabilities
- Details
-
Updated libvirt packages fix security vulnerabilities:
An information leak which allowed to retrieve the guest hostname under readonly mode (CVE-2019-3886).
Wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132).
Arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161).
virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166).
Arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167).
Arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168).
Also, this update contains the libvirt adjustments, that pass through the new 'md-clear' CPU flag, to help address Intel CPU speculative execution flaws.
- References
-
- https://advisories.mageia.org/MGASA-2019-0390.html
- https://bugs.mageia.org/show_bug.cgi?id=24757
- https://lists.opensuse.org/opensuse-updates/2019-04/msg00207.html
- https://access.redhat.com/errata/RHSA-2019:1264
- https://access.redhat.com/errata/RHSA-2019:1579
- https://lists.opensuse.org/opensuse-updates/2019-06/msg00023.html
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:7 / libvirt
Package
- Name
- libvirt
- Purl
- pkg:rpm/mageia/libvirt?distro=mageia-7
Mageia:7 / python-libvirt
Package
- Name
- python-libvirt
- Purl
- pkg:rpm/mageia/python-libvirt?distro=mageia-7