Red Hat Security AdvisoryRHSA-2014:1873
libvirt security and bug fix update
Released 2014-11-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) libvirt-0.10.2-46.el6_6.2, libvirt-client-0.10.2-46.el6_6.2, libvirt-python-0.10.2-46.el6_6.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) libvirt-devel-0.10.2-46.el6_6.2, libvirt-lock-sanlock-0.10.2-46.el6_6.2
- Red Hat Enterprise Linux HPC Node (v. 6) libvirt-0.10.2-46.el6_6.2, libvirt-client-0.10.2-46.el6_6.2, libvirt-python-0.10.2-46.el6_6.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libvirt-devel-0.10.2-46.el6_6.2, libvirt-lock-sanlock-0.10.2-46.el6_6.2
- Red Hat Enterprise Linux Server (v. 6) libvirt-0.10.2-46.el6_6.2, libvirt-client-0.10.2-46.el6_6.2, libvirt-client-0.10.2-46.el6_6.2.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 6) libvirt-lock-sanlock-0.10.2-46.el6_6.2
- Red Hat Enterprise Linux Workstation (v. 6) libvirt-0.10.2-46.el6_6.2, libvirt-client-0.10.2-46.el6_6.2, libvirt-devel-0.10.2-46.el6_6.2 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) libvirt-lock-sanlock-0.10.2-46.el6_6.2
Fixes 3 records
Priority LOW 31
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read s…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.02751 · Published 2014-10-06 · Partial fix CWE-119
Priority LOW 28
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value i…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02791 · Published 2014-10-06 · Partial fix CWE-399
Priority LOW 27
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01905 · Published 2014-11-13 · Partial fix CWE-255
THREATIST.IORead the docs