Package "libvirt-dev"
| Name: |
libvirt-dev
|
Description: |
development files for the libvirt library
|
| Latest version: |
4.0.0-1ubuntu8.21 |
| Release: |
bionic (18.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
libvirt |
| Homepage: |
http://libvirt.org |
Links
Download "libvirt-dev"
Other versions of "libvirt-dev" in Bionic
Changelog
|
libvirt (4.0.0-1ubuntu8.21) bionic-security; urgency=medium
* SECURITY UPDATE: crash via double-free memory issue
- debian/patches/CVE-2020-25637-1.patch: gendispatch: handle empty
flags in src/rpc/gendispatch.pl.
- debian/patches/CVE-2020-25637-2.patch: add support for filtering
@acls by uint params in src/remote/remote_protocol.x,
src/rpc/gendispatch.pl.
- debian/patches/CVE-2020-25637-3.patch: require write acl for guest
agent in src/libxl/libxl_driver.c, src/qemu/qemu_driver.c,
src/remote/remote_protocol.x.
- debian/patches/CVE-2020-25637-4.patch: set ifname to NULL after
freeing in src/qemu/qemu_agent.c.
- CVE-2020-25637
* SECURITY UPDATE: sVirt SELinux confinement flaw
- debian/patches/CVE-2021-3631.patch: fix SELinux label generation
logic in src/security/security_selinux.c.
- CVE-2021-3631
* SECURITY UPDATE: segmentation fault during VM shutdown
- debian/patches/CVE-2021-3975.patch: add missing lock in
qemuProcessHandleMonitorEOF in src/qemu/qemu_process.c.
- CVE-2021-3975
* SECURITY UPDATE: DoS via libxl driver
- debian/patches/CVE-2021-4147-pre0.patch: handle external domain
destroy in src/libxl/libxl_domain.c, src/libxl/libxl_domain.h.
- debian/patches/CVE-2021-4147-pre1.patch: fix domain shutdown in
src/libxl/libxl_domain.c.
- debian/patches/CVE-2021-4147-1.patch: disable death events after
receiving a shutdown event in src/libxl/libxl_domain.c,
src/libxl/libxl_domain.h.
- debian/patches/CVE-2021-4147-2.patch: rename libxlShutdownThreadInfo
struct in src/libxl/libxl_domain.c.
- debian/patches/CVE-2021-4147-3.patch: modify name of shutdown thread
in src/libxl/libxl_domain.c.
- debian/patches/CVE-2021-4147-4.patch: handle domain death events in a
thread in src/libxl/libxl_domain.c.
- debian/patches/CVE-2021-4147-5.patch: search for virDomainObj in
event handler threads in src/libxl/libxl_domain.c.
- debian/patches/CVE-2021-4147-6pre1.patch: avoid virHashFree by
rearranging code in src/libxl/libxl_logger.c.
- debian/patches/CVE-2021-4147-6.patch: protect access to libxlLogger
files hash table in src/libxl/libxl_logger.c.
- CVE-2021-4147
* SECURITY UPDATE: DoS via nwfilter driver
- debian/patches/CVE-2022-0897.patch: fix crash when counting number of
network filters in src/nwfilter/nwfilter_driver.c.
- CVE-2022-0897
-- Marc Deslauriers <email address hidden> Wed, 20 Apr 2022 13:18:06 -0400
|
| Source diff to previous version |
| CVE-2020-25637 |
A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network inte |
| CVE-2021-3631 |
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access fil |
| CVE-2021-3975 |
segmentation fault during VM shutdown can lead to vdsm hung |
| CVE-2021-4147 |
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, |
| CVE-2022-0897 |
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before i |
|
|
libvirt (4.0.0-1ubuntu8.17) bionic-security; urgency=medium
* SECURITY UPDATE: denial of service via active pool without target path
- debian/patches/ubuntu/CVE-2020-10703.patch: fix daemon crash on
lookup storagepool by targetpath in src/storage/storage_driver.c.
- CVE-2020-10703
-- Marc Deslauriers <email address hidden> Wed, 06 May 2020 14:18:23 -0400
|
| Source diff to previous version |
| CVE-2020-10703 |
Potential denial of service via active pool without target path |
|
|
libvirt (4.0.0-1ubuntu8.12) bionic-security; urgency=medium
* SECURITY UPDATE: virDomainSaveImageGetXMLDesc does not check for
read-only connection
- debian/patches/CVE-2019-10161.patch: add check to
src/libvirt-domain.c, src/qemu/qemu_driver.c,
src/remote/remote_protocol.x.
- CVE-2019-10161
* SECURITY UPDATE: virDomainManagedSaveDefineXML does not check for
read-only connection
- debian/patches/CVE-2019-10166.patch: add check to
src/libvirt-domain.c.
- CVE-2019-10166
* SECURITY UPDATE: virConnectGetDomainCapabilities does not check for
read-only connection
- debian/patches/CVE-2019-10167.patch: add check to
src/libvirt-domain.c.
- CVE-2019-10167
-- Marc Deslauriers <email address hidden> Tue, 02 Jul 2019 09:19:33 -0400
|
| Source diff to previous version |
| CVE-2019-10161 |
arbitrary file read/exec via virDomainSaveImageGetXMLDesc API |
| CVE-2019-10166 |
virDomainManagedSaveDefineXML API exposed to readonly clients |
| CVE-2019-10167 |
arbitrary command execution via virConnectGetDomainCapabilities API |
|
|
libvirt (4.0.0-1ubuntu8.10) bionic-security; urgency=medium
* SECURITY UPDATE: Add support for md-clear functionality
- debian/patches/md-clear.patch: Define md-clear CPUID bit in
src/cpu/cpu_map.xml.
- CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
-- Marc Deslauriers <email address hidden> Tue, 14 May 2019 15:11:45 -0400
|
| Source diff to previous version |
|
|
|
libvirt (4.0.0-1ubuntu8.8) bionic-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference in qemuAgentGetInterfaces
- debian/patches/CVE-2019-3840.patch: require a reply in
src/qemu/qemu_agent.c.
- CVE-2019-3840
-- Marc Deslauriers <email address hidden> Wed, 13 Mar 2019 08:09:33 -0400
|
| CVE-2019-3840 |
NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function |
|
About
-
Send Feedback to @ubuntu_updates
