Advisories ยป MGASA-2019-0390

Updated libvirt packages fix security vulnerabilities

Publication date: 15 Dec 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-3886 , CVE-2019-10132 , CVE-2019-10161 , CVE-2019-10166 , CVE-2019-10167 , CVE-2019-10168

Description

Updated libvirt packages fix security vulnerabilities:

An information leak which allowed to retrieve the guest hostname
under readonly mode (CVE-2019-3886).

Wrong permissions in systemd admin-sock due to missing SocketMode
parameter (CVE-2019-10132).

Arbitrary file read/exec via virDomainSaveImageGetXMLDesc API
(CVE-2019-10161).

virDomainManagedSaveDefineXML API exposed to readonly clients
(CVE-2019-10166).

Arbitrary command execution via virConnectGetDomainCapabilities API
(CVE-2019-10167).

Arbitrary command execution via virConnectBaselineHypervisorCPU and
virConnectCompareHypervisorCPU APIs (CVE-2019-10168).

Also, this update contains the libvirt adjustments, that pass through
the new 'md-clear' CPU flag, to help address Intel CPU speculative
execution flaws.
                

References

SRPMS

7/core