USN-2867-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-2867-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2867-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-2867-1

Related

Published

2016-01-12T18:06:25.120919Z

Modified

2016-01-12T18:06:25.120919Z

Summary

libvirt vulnerabilities

Details

It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600)

Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-0236)

Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5247)

Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313)

References

Affected packages

Ubuntu:14.04:LTS / libvirt

Package

Name: libvirt
Purl: pkg:deb/ubuntu/libvirt?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.2-0ubuntu13.1.16

Affected versions

1.*

1.1.1-0ubuntu8

1.1.1-0ubuntu9

1.1.4-0ubuntu2

1.1.4-0ubuntu3

1.1.4-0ubuntu4

1.1.4-0ubuntu5

1.2.0-0ubuntu1

1.2.0-0ubuntu2

1.2.0-0ubuntu3

1.2.1-0ubuntu1

1.2.1-0ubuntu2

1.2.1-0ubuntu3

1.2.1-0ubuntu4

1.2.1-0ubuntu5

1.2.1-0ubuntu7

1.2.1-0ubuntu8

1.2.1-0ubuntu9

1.2.1-0ubuntu10

1.2.2-0ubuntu1

1.2.2-0ubuntu2

1.2.2-0ubuntu3

1.2.2-0ubuntu4

1.2.2-0ubuntu5

1.2.2-0ubuntu6

1.2.2-0ubuntu7

1.2.2-0ubuntu8

1.2.2-0ubuntu9

1.2.2-0ubuntu10

1.2.2-0ubuntu11

1.2.2-0ubuntu12

1.2.2-0ubuntu13

1.2.2-0ubuntu13.1

1.2.2-0ubuntu13.1.1

1.2.2-0ubuntu13.1.2

1.2.2-0ubuntu13.1.4

1.2.2-0ubuntu13.1.5

1.2.2-0ubuntu13.1.6

1.2.2-0ubuntu13.1.7

1.2.2-0ubuntu13.1.8

1.2.2-0ubuntu13.1.9

1.2.2-0ubuntu13.1.10

1.2.2-0ubuntu13.1.12

1.2.2-0ubuntu13.1.14

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt-bin"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt-bin-dbgsym"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt-dev"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt-dev-dbgsym"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt-doc"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt0"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt0-dbg"
        },
        {
            "binary_version": "1.2.2-0ubuntu13.1.16",
            "binary_name": "libvirt0-dbgsym"
        }
    ]
}