Red Hat Security AdvisoryRHSA-2015:0323
libvirt security, bug fix, and enhancement update
Released 2015-03-05 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libvirt-1.2.8-16.el7, libvirt-client-1.2.8-16.el7, libvirt-daemon-1.2.8-16.el7 +11
- Red Hat Enterprise Linux Client Optional (v. 7) libvirt-daemon-lxc-1.2.8-16.el7, libvirt-devel-1.2.8-16.el7, libvirt-docs-1.2.8-16.el7 +2
- Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-1.2.8-16.el7, libvirt-client-1.2.8-16.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-1.2.8-16.el7, libvirt-daemon-1.2.8-16.el7, libvirt-daemon-config-network-1.2.8-16.el7 +15
- Red Hat Enterprise Linux Server (v. 7) libvirt-1.2.8-16.el7, libvirt-client-1.2.8-16.el7, libvirt-client-1.2.8-16.el7.ppc +15
- Red Hat Enterprise Linux Server Optional (v. 7) libvirt-daemon-lxc-1.2.8-16.el7, libvirt-lock-sanlock-1.2.8-16.el7, libvirt-login-shell-1.2.8-16.el7
- Red Hat Enterprise Linux Workstation (v. 7) libvirt-1.2.8-16.el7, libvirt-client-1.2.8-16.el7, libvirt-daemon-1.2.8-16.el7 +13
- Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-daemon-lxc-1.2.8-16.el7, libvirt-lock-sanlock-1.2.8-16.el7, libvirt-login-shell-1.2.8-16.el7
- Red Hat Gluster Storage Server 3.1 on RHEL-7 libvirt-daemon-lxc-1.2.8-16.el7, libvirt-lock-sanlock-1.2.8-16.el7, libvirt-login-shell-1.2.8-16.el7
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts libvirt-1.2.8-16.el7, libvirt-lock-sanlock-1.2.8-16.el7
Fixes 2 records
Priority LOW 20
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDo…
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.01802 · Published 2015-01-29 · Partial fix CWE-200
Priority LOW 11
The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unsp…
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00394 · Published 2014-12-19 · Partial fix CWE-264
