Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:14100-1

Опубликовано: 21 июн. 2019
Источник: suse-cvrf

Описание

Security update for libvirt

This update for libvirt fixes the following issues:

Security issue fixed:

  • CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
libvirt-1.0.5.9-21.20.1
libvirt-client-1.0.5.9-21.20.1
libvirt-doc-1.0.5.9-21.20.1
libvirt-lock-sanlock-1.0.5.9-21.20.1
libvirt-python-1.0.5.9-21.20.1

Ссылки

Описание

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:libvirt-1.0.5.9-21.20.1
SUSE Linux Enterprise Point of Sale 11 SP3:libvirt-client-1.0.5.9-21.20.1
SUSE Linux Enterprise Point of Sale 11 SP3:libvirt-doc-1.0.5.9-21.20.1
SUSE Linux Enterprise Point of Sale 11 SP3:libvirt-lock-sanlock-1.0.5.9-21.20.1
Ссылки
Уязвимость SUSE-SU-2019:14100-1