Read the docs
Red Hat Security Advisory

RHSA-2019:1580

virt:rhel security update

Released 2019-06-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2019-07489 CVE-2019-10168 · GHSA-v3hc-v42h-rp66

Improper access control in libvirt

Priority LOW 35

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00549 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250
TI-2019-07488 CVE-2019-10167 · GHSA-5p5j-3wqp-w634

Improper access control in libvirt

Priority LOW 35

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00521 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250
TI-2019-07482 CVE-2019-10161 · GHSA-6cwp-pxj6-56c7

Improper access control in libvirt

Priority LOW 35

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00516 Published 2019-07-30 Fixed CWE-284
TI-2019-07487 CVE-2019-10166 · GHSA-g9cg-gvh5-48hm

Improper access control in libvirt

Priority LOW 34

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state fil…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00469 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-284