Security update for libvirt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14097-1 Final 1 1 2019-06-21T08:18:46Z current 2019-06-21T08:18:46Z 2019-06-21T08:18:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libvirt This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301). - CVE-2019-3886: Fixed a information exposure which allowed to retrieve the guest hostname under readonly mode (bsc#1131595). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-libvirt-14097 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914097-1/ Link for SUSE-SU-2019:14097-1 https://lists.suse.com/pipermail/sle-security-updates/2019-June/005597.html E-Mail link for SUSE-SU-2019:14097-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1131595 SUSE Bug 1131595 https://bugzilla.suse.com/1138301 SUSE Bug 1138301 https://www.suse.com/security/cve/CVE-2019-10161/ SUSE CVE CVE-2019-10161 page https://www.suse.com/security/cve/CVE-2019-3886/ SUSE CVE CVE-2019-3886 page SUSE Linux Enterprise Server 11 SP4-LTSS libvirt-1.2.5-23.20.1 libvirt-client-1.2.5-23.20.1 libvirt-client-32bit-1.2.5-23.20.1 libvirt-doc-1.2.5-23.20.1 libvirt-lock-sanlock-1.2.5-23.20.1 libvirt-1.2.5-23.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libvirt-client-1.2.5-23.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libvirt-client-32bit-1.2.5-23.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libvirt-doc-1.2.5-23.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libvirt-lock-sanlock-1.2.5-23.20.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. CVE-2019-10161 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-client-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-client-32bit-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-doc-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-lock-sanlock-1.2.5-23.20.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914097-1/ https://www.suse.com/security/cve/CVE-2019-10161.html CVE-2019-10161 https://bugzilla.suse.com/1138301 SUSE Bug 1138301 An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block. CVE-2019-3886 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-client-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-client-32bit-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-doc-1.2.5-23.20.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libvirt-lock-sanlock-1.2.5-23.20.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914097-1/ https://www.suse.com/security/cve/CVE-2019-3886.html CVE-2019-3886 https://bugzilla.suse.com/1131595 SUSE Bug 1131595 https://bugzilla.suse.com/1133150 SUSE Bug 1133150 https://bugzilla.suse.com/1138301 SUSE Bug 1138301