OESA-2026-3831

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3831
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3831.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3831
Upstream
  • CVE-2026-63623
Published
2026-09-14T16:34:48Z
Modified
2026-09-13T16:45:47Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
libvirt security update
Details

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / libvirt

Package

Name
libvirt
Purl
pkg:rpm/openEuler/libvirt&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.10.0-37.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "libvirt-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-client-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-common-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-config-network-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-interface-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-network-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-secret-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-kvm-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-lock-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-log-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-proxy-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-daemon-qemu-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-debuginfo-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-debugsource-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-devel-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-docs-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-libs-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-nss-9.10.0-37.oe2403sp1.aarch64.rpm",
        "libvirt-wireshark-9.10.0-37.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "libvirt-9.10.0-37.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "libvirt-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-client-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-common-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-config-network-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-interface-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-network-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-secret-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-kvm-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-lock-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-log-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-proxy-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-daemon-qemu-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-debuginfo-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-debugsource-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-devel-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-docs-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-libs-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-nss-9.10.0-37.oe2403sp1.x86_64.rpm",
        "libvirt-wireshark-9.10.0-37.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3831.json"