SUSE-SU-2016:0304-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2016/suse-su-20160304-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0304-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2016:0304-1

Related

Published

2016-02-01T15:46:51Z

Modified

2016-02-01T15:46:51Z

Summary

Security update for libvirt

Details

libvirt was updated to fix one security issue and several non-security issues.

This security issue was fixed:

CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC password by using the VIRDOMAINXML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. (bsc#914693)
CVE-2015-5313: path traversal vulnerability allowed libvirtd process to write arbitrary files into file system using root permissions (bsc#953110)

Theses non-security issues were fixed:

bsc#948686: Use PAUSED state for domains that are starting up.
bsc#903757: Provide nodeGetSecurityModel implementation in libxl.
bsc#938228: Set disk type to BLOCK when driver is not tap or file.
bsc#948516: Fix profile_status to distinguish between errors and unconfined domains.
bsc#936524: Fix error starting lxc containers with direct interfaces.
bsc#921555: Fixed apparmor generated profile for PCI hostdevs.
bsc#899334: Include additional upstream fixes for systemd TerminateMachine.
bsc#921586: Fix security driver default settings in /etc/libvirt/qemu.conf.
bsc#921355: Fixed a number of QEMU apparmor abstraction problems.
bsc#911737: Additional fix for the case where security labels aren't automatically set.
bsc#914297: Allow setting the URL of an SMT server to use in place of SCC.
bsc#904432: Backported route definition changes.

References

Affected packages

SUSE:Linux Enterprise Desktop 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Desktop%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-daemon-driver-nwfilter": "1.2.5-27.10.1",
            "libvirt-daemon-lxc": "1.2.5-27.10.1",
            "libvirt-doc": "1.2.5-27.10.1",
            "libvirt-daemon-driver-storage": "1.2.5-27.10.1",
            "libvirt-daemon-driver-libxl": "1.2.5-27.10.1",
            "libvirt-daemon-config-network": "1.2.5-27.10.1",
            "libvirt-daemon-driver-interface": "1.2.5-27.10.1",
            "libvirt-daemon-driver-secret": "1.2.5-27.10.1",
            "libvirt-daemon-driver-network": "1.2.5-27.10.1",
            "libvirt-daemon-driver-nodedev": "1.2.5-27.10.1",
            "libvirt-daemon-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-config-nwfilter": "1.2.5-27.10.1",
            "libvirt-daemon-driver-lxc": "1.2.5-27.10.1",
            "libvirt-daemon-driver-qemu": "1.2.5-27.10.1",
            "libvirt-client": "1.2.5-27.10.1",
            "libvirt-daemon-xen": "1.2.5-27.10.1",
            "libvirt-client-32bit": "1.2.5-27.10.1",
            "libvirt": "1.2.5-27.10.1",
            "libvirt-daemon": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-client-32bit": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-daemon-driver-nwfilter": "1.2.5-27.10.1",
            "libvirt-daemon-lxc": "1.2.5-27.10.1",
            "libvirt-doc": "1.2.5-27.10.1",
            "libvirt-daemon-driver-storage": "1.2.5-27.10.1",
            "libvirt-daemon-driver-libxl": "1.2.5-27.10.1",
            "libvirt-daemon-config-network": "1.2.5-27.10.1",
            "libvirt-lock-sanlock": "1.2.5-27.10.1",
            "libvirt-daemon-driver-secret": "1.2.5-27.10.1",
            "libvirt-daemon-driver-network": "1.2.5-27.10.1",
            "libvirt-daemon-driver-nodedev": "1.2.5-27.10.1",
            "libvirt-daemon-driver-interface": "1.2.5-27.10.1",
            "libvirt-daemon-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-config-nwfilter": "1.2.5-27.10.1",
            "libvirt-client": "1.2.5-27.10.1",
            "libvirt-daemon-driver-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-driver-lxc": "1.2.5-27.10.1",
            "libvirt-daemon-xen": "1.2.5-27.10.1",
            "libvirt": "1.2.5-27.10.1",
            "libvirt-daemon": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-devel": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-daemon-driver-nwfilter": "1.2.5-27.10.1",
            "libvirt-daemon-lxc": "1.2.5-27.10.1",
            "libvirt-doc": "1.2.5-27.10.1",
            "libvirt-daemon-driver-storage": "1.2.5-27.10.1",
            "libvirt-daemon-driver-libxl": "1.2.5-27.10.1",
            "libvirt-daemon-config-network": "1.2.5-27.10.1",
            "libvirt-lock-sanlock": "1.2.5-27.10.1",
            "libvirt-daemon-driver-secret": "1.2.5-27.10.1",
            "libvirt-daemon-driver-network": "1.2.5-27.10.1",
            "libvirt-daemon-driver-nodedev": "1.2.5-27.10.1",
            "libvirt-daemon-driver-interface": "1.2.5-27.10.1",
            "libvirt-daemon-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-config-nwfilter": "1.2.5-27.10.1",
            "libvirt-client": "1.2.5-27.10.1",
            "libvirt-daemon-driver-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-driver-lxc": "1.2.5-27.10.1",
            "libvirt-daemon-xen": "1.2.5-27.10.1",
            "libvirt": "1.2.5-27.10.1",
            "libvirt-daemon": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-client-32bit": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-daemon-driver-nwfilter": "1.2.5-27.10.1",
            "libvirt-daemon-lxc": "1.2.5-27.10.1",
            "libvirt-doc": "1.2.5-27.10.1",
            "libvirt-daemon-driver-storage": "1.2.5-27.10.1",
            "libvirt-daemon-driver-libxl": "1.2.5-27.10.1",
            "libvirt-daemon-config-network": "1.2.5-27.10.1",
            "libvirt-lock-sanlock": "1.2.5-27.10.1",
            "libvirt-daemon-driver-secret": "1.2.5-27.10.1",
            "libvirt-daemon-driver-network": "1.2.5-27.10.1",
            "libvirt-daemon-driver-nodedev": "1.2.5-27.10.1",
            "libvirt-daemon-driver-interface": "1.2.5-27.10.1",
            "libvirt-daemon-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-config-nwfilter": "1.2.5-27.10.1",
            "libvirt-client": "1.2.5-27.10.1",
            "libvirt-daemon-driver-qemu": "1.2.5-27.10.1",
            "libvirt-daemon-driver-lxc": "1.2.5-27.10.1",
            "libvirt-daemon-xen": "1.2.5-27.10.1",
            "libvirt": "1.2.5-27.10.1",
            "libvirt-daemon": "1.2.5-27.10.1"
        }
    ]
}

SUSE:Linux Enterprise Workstation Extension 12 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.5-27.10.1

Ecosystem specific

{
    "binaries": [
        {
            "libvirt-client-32bit": "1.2.5-27.10.1"
        }
    ]
}