UbuntuUpdates.org

Package "libvirt0"

Name: libvirt0

Description:

library for interfacing with different virtualization systems
Latest version: 10.0.0-2ubuntu8.2
Release: noble (24.04)
Level: security
Repository: main
Head package: libvirt
Homepage: https://libvirt.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libvirt0"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libvirt0" in Noble

Repository Area Version
base main 10.0.0-2ubuntu8
updates main 10.0.0-2ubuntu8.4

Changelog

Version: 10.0.0-2ubuntu8.2 2024-05-07 13:07:25 UTC

  libvirt (10.0.0-2ubuntu8.2) noble-security; urgency=medium

  * SECURITY UPDATE: stack use-after-free in virNetClientIOEventLoop()
    - debian/patches/CVE-2024-4418.patch: ensure temporary GSource is
      removed from client event loop in src/rpc/virnetclient.c.
    - CVE-2024-4418

 -- Marc Deslauriers <email address hidden> Mon, 06 May 2024 09:12:37 -0400
Source diff to previous version
CVE-2024-4418 stack use-after-free in virNetClientIOEventLoop()

Version: 10.0.0-2ubuntu8.1 2024-04-29 13:07:04 UTC

  libvirt (10.0.0-2ubuntu8.1) noble-security; urgency=medium

  * SECURITY UPDATE: off-by-one in udevListInterfacesByStatus()
    - debian/patches/CVE-2024-1441.patch: properly check count in
      src/interface/interface_backend_udev.c.
    - CVE-2024-1441
  * SECURITY UPDATE: crash in RPC library
    - debian/patches/CVE-2024-2494.patch: check values in
      src/remote/remote_daemon_dispatch.c, src/rpc/gendispatch.pl.
    - CVE-2024-2494

 -- Marc Deslauriers <email address hidden> Thu, 18 Apr 2024 11:42:32 -0400
CVE-2024-1441 An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `nam
CVE-2024-2494 A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length c


About   -   Send Feedback to @ubuntu_updates