bugtraq - [SECURITY] [DSA 4137-1] libvirt security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 14 Mar 2018 22:50:24 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4137-1] libvirt security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4137-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
March 14, 2018                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libvirt
CVE ID         : CVE-2018-1064 CVE-2018-5748 CVE-2018-6764

Several vulnerabilities were discovered in Libvirt, a virtualisation
abstraction library:

CVE-2018-1064

    Denial Berrange discovered that the QEMU guest agent performed
    insufficient validationof incoming data, which allows a privileged
    user in the guest to exhaust resources on the virtualisation host,
    resulting in denial of service.

CVE-2018-5748

    Daniel Berrange and Peter Krempa that the QEMU monitor was suspectible
    to denial of service by memory exhaustion. This was already fixed in
    Debian stretch and only affects Debian jessie.

CVE-2018-6764

    Pedro Sampaio discovered that LXC containes detected the hostname
    insecurely. This only affects Debian stretch.

For the oldstable distribution (jessie), these problems have been fixed
in version 1.2.9-9+deb8u5.

For the stable distribution (stretch), these problems have been fixed in
version 3.0.0-4+deb9u3.

We recommend that you upgrade your libvirt packages.

For the detailed security status of libvirt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libvirt

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlqpl6wACgkQEMKTtsN8
Tjb6qw/+MeW4HJxYNAaOyU4h4hCXgPOonjHvoveKaGzKqxiNbw9x7bWFA9dxu+yA
X4TWc91LHKhAXpvvet9qkr/IAOjHAy0Vy4GR8tUuaDyJ3VD5B+KX16rYd1r7loDG
2Cc/70YAxPn9p24ZUhHdEf4XOVj/3di6UWi2VxI6LsW4Ih5rpG5Ka+Vj6/zQVOKn
QAqXkiQf1fB1A9jUvl4jZ0TxyCe8mCp6xKyZpdw0MBtMfJ9APa6FosWhzjXy51Pw
vRmdZ33CLREd9IINw4vtgA1AnGCTJKwrQC8Pb6vhj2ukRgSRYJoIiZX2yNyULtXo
LwsIiGnvalqGF17NnkfJYsve04twMyqwvr+0xb5kU+CmmbmjJBJ0crYm+TfnTHrA
f+tI/zdr59BLVDD+YucEsDtXnoyy9xtJ4rvZE1G3SqM+qJSQNLsi+TAjQDkFaBOO
9dGG+mG8Omk3Y7UgazU69iT4Pg7DpF3DNG7jjhbJSKSfLXyo/Y842ySqSnzJTP3j
fCVg5G7dNDGBSHuSMIL3/T6+htJBdeKEdXamB912/fYa0lphpKhPYTvEeiHZYnGb
qzUzMpazmlpw1MmBZCCxFcPxK8vBYR5NNZewPd08QPaDHKsnyqG9ZI9zIuixsuF4
RQZJGxnvh9juPiBTaffkgdNm3bVWVI9mxvWhreZN3tK11lNZdC8=
=evCW
-----END PGP SIGNATURE-----