Multiple vulnerabilities have been discovered in libvirt, the worst of which could lead to a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 10.2.0 | >= 10.2.0 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-10.2.0"
Multiple vulnerabilities have been discovered in libvirt, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 8.2.0 | >= 8.2.0 |
| dev-python/libvirt-python | * | < 8.2.0 | >= 8.2.0 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-8.2.0"
All libvirt-python users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/libvirt-python-8.2.0"
A vulnerability in libvirt may allow root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 6.7.0 | >= 6.7.0 |
libvirt is a C toolkit for manipulating virtual machines.
A file descriptor for /dev/mapper/control was insufficiently protected.
A local attacker may be able to escalate to root privileges.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-6.7.0"
Multiple vulnerabilities have been discovered in libvirt, the worst of which may result in the execution of arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 5.4.1 | >= 5.4.1 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
A local privileged attacker could execute arbitrary commands, escalate privileges or cause a Denial of Service condition.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-5.4.1"
Multiple vulnerabilities have been discovered in libvirt, the worst of which may result in the execution of arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 4.1.0 | >= 4.1.0 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
A local privileged attacker could execute arbitrary commands or cause a Denial of Service condition.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-4.1.0"
Libvirt is vulnerable to directory traversal when using Access Control Lists (ACL).
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.2.21-r1 | >= 1.2.21-r1 |
libvirt is a C toolkit for manipulating virtual machines.
Normally, only privileged users can coerce libvirt into creating or opening existing files using the virStorageVol APIs; and such users already have full privilege to create any domain XML.
But in the case of fine-grained ACLs, it is feasible that a user can be granted storage_vol:create but not domain:write, and it violates assumptions if such a user can abuse libvirt to access files outside of the storage pool.
When fine-grained Access Control Lists (ACL) are in effect, an authenticated local user with storage_vol:create permission but without domain:write permission maybe able to create or access arbitrary files outside of the storage pool.
Don’t make use of fine-grained Access Control Lists (ACL) in libvirt; In Gentoo, libvirt’s ACL support is disable by default unless you enable the “policykit” USE flag.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.2.21-r1"
Multiple vulnerabilities have been found in libvirt, worst of which allows context-dependent attackers to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.2.10-r3 | >= 1.2.10-r3 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
A context-dependent attacker may be able to cause Denial of Service.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.2.10-r3"
Multiple vulnerabilities have been found in libvirt, worst of which allows context-dependent attackers to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.2.9-r2 | >= 1.2.9-r2 |
libvirt is a C toolkit for manipulating virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to cause a Denial of Service or cause information leakage. A local attacker may be able to escalate privileges, cause a Denial of Service or possibly execute arbitrary code.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.2.9-r2"
A race condition in polkit could allow a local attacker to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.1.2-r3 | >= 1.1.2-r3 |
| net-misc/spice-gtk | * | < 0.21 | >= 0.21 |
| net-print/hplip | * | < 3.14.1 | >= 3.14.1 |
| sys-apps/systemd | * | < 204-r1 | >= 204-r1 |
| sys-auth/polkit | * | < 0.112 | >= 0.112 |
polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.
polkit has a race condition which potentially allows a process to change its UID/EUID via suid or pkexec before authentication is completed.
A local attacker could start a suid or pkexec process through a polkit-enabled application, which could result in privilege escalation or bypass of polkit restrictions.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.112"
All HPLIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/hplip-3.14.1"
All Spice-Gtk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/spice-gtk-0.21"
All systemd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/systemd-204-r1"
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.1.2-r3"
Multiple vulnerabilities have been found in libvirt, allowing remote attackers to execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.0.5.1-r3 | >= 1.0.5.1-r3 |
libvirt is a C toolkit for manipulating virtual machines.
An error in the virNetMessageFree() function in rpc/virnetserverclient.c can lead to a use-after-free. Additionally, a socket leak in the remoteDispatchStoragePoolListAllVolumes command can lead to file descriptor exhaustion.
A remote attacker could cause certain errors during an RPC connection to cause a message to be freed without being removed from the message queue, possibly resulting in execution of arbitrary code or a Denial of Service condition. Additionally, a remote attacker could repeatedly issue the command to list all pool volumes, causing a Denial of Service condition.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.0.5.1-r3"
Multiple vulnerabilities were found in libvirt, the worst of which might allow guest OS users to read arbitrary files on the host OS.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 0.9.3-r1 | >= 0.9.3-r1 |
libvirt is a C toolkit to manipulate virtual machines.
Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details.
These vulnerabilities allow a remote attacker to cause a Denial of Service condition on the host server or libvirt daemon, or might allow guest OS users to read arbitrary files on the host OS.
There is no known workaround at this time.
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-0.9.3-r1"