This update for libvirt and virt-manager fixes the following issues:
Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625). Non-security issues fixed in     libvirt :

  - bsc#1070615: Fixed TPM device passthrough failure on     kernels >= 4.0.

  - bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted     to pvhvm. Unless vm memory is on gig boundary, vm won't     boot.

  - bsc#1082161: Unable to change RTC basis or adjustment     for Xen HVM guests using libvirt. Non-security issues     fixed in virt-manager :

  - bsc#1086038: VM guests cannot be properly installed with     virt-install

  - bsc#1067018: KVM Guest creation failed - Property .cmt     not found

  - bsc#1054986: Fix openSUSE 15.0 detection. It has no     content file or .treeinfo file

  - bsc#1085757: Fallback to latest version of openSUSE when     opensuse-unknown is detected for the ISO

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt and virt-manager fixes the following issues :

Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625).

Non-security issues fixed in libvirt :

  - bsc#1070615: Fixed TPM device passthrough failure on     kernels >= 4.0.

  - bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted     to pvhvm. Unless vm memory is on gig boundary, vm won't     boot.

  - bsc#1082161: Unable to change RTC basis or adjustment     for Xen HVM guests using libvirt.

Non-security issues fixed in virt-manager :

  - bsc#1086038: VM guests cannot be properly installed with     virt-install

  - bsc#1067018: KVM Guest creation failed - Property .cmt     not found

  - bsc#1054986: Fix openSUSE 15.0 detection. It has no     content file or .treeinfo file

  - bsc#1085757: Fallback to latest version of openSUSE when     opensuse-unknown is detected for the ISO

This update was imported from the SUSE:SLE-12-SP3:Update update project.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.(CVE-2018-6764)

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles     the holding of a monitor job during a query to a guest     agent, which allows attackers to cause a denial of     service (API blockage).(CVE-2019-20485)

  - It was discovered that libvirtd before versions 4.10.1     and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an     arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with     access to the libvirtd socket could use this to probe     the existence of arbitrary files, cause denial of     service or cause libvirtd to execute arbitrary     programs.(CVE-2019-10161)

  - The virConnectGetDomainCapabilities() libvirt API,     versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an 'emulatorbin' argument to specify the     program providing emulation for a domain. Since     v1.2.19, libvirt will execute that program to probe the     domain's capabilities. Read-only clients could specify     an arbitrary path for this argument, causing libvirtd     to execute a crafted executable with its own     privileges.(CVE-2019-10167)

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues: Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625). Non-security issues fixed :

  - Error starting domain: internal error: No usable sysfs     TPM cancel file could be found (bsc#1078808).

  - SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm.
    Unless vm memory is on gig boundary, vm won't boot     (bsc#1082041).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109012	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0920-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/4/12	2024/11/7	high
109020	openSUSE Security Update : libvirt (openSUSE-2018-358) (Spectre)	Nessus	SuSE Local Security Checks	2018/4/13	2024/11/7	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
119788	Amazon Linux 2 : libvirt (ALAS-2018-1134)	Nessus	Amazon Linux Local Security Checks	2018/12/20	2024/7/15	high
141658	EulerOS Virtualization 3.0.2.2 : libvirt (EulerOS-SA-2020-2209)	Nessus	Huawei Local Security Checks	2020/10/21	2024/2/14	high
108827	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0861-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/4/4	2024/11/21	high

检测

插件搜索

high

high

high

high

high

high