RedHat: RHSA-2019-1578:01 Moderate: libvirt security update

    Date20 Jun 2019
    CategoryRed Hat
    2509
    Posted ByLinuxSecurity Advisories
    An update for libvirt is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: libvirt security update
    Advisory ID:       RHSA-2019:1578-01
    Product:           Red Hat Enterprise Linux
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:1578
    Issue date:        2019-06-20
    CVE Names:         CVE-2019-10161 
    =====================================================================
    
    1. Summary:
    
    An update for libvirt is now available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
    Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
    Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
    Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
    Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
    Red Hat Enterprise Linux Server Optional (v. 6) - x86_64
    Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
    Red Hat Enterprise Linux Workstation Optional (v. 6) - x86_64
    
    3. Description:
    
    The libvirt library contains a C API for managing and interacting with the
    virtualization capabilities of Linux and other operating systems. In
    addition, libvirt provides tools for remote management of virtualized
    systems.
    
    Security Fix(es):
    
    * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API
    (CVE-2019-10161)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    After installing the updated packages, libvirtd will be restarted
    automatically.
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1720115 - CVE-2019-10161 libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API
    
    6. Package List:
    
    Red Hat Enterprise Linux Desktop (v. 6):
    
    Source:
    libvirt-0.10.2-64.el6_10.2.src.rpm
    
    i386:
    libvirt-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-python-0.10.2-64.el6_10.2.i686.rpm
    
    x86_64:
    libvirt-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-python-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux Desktop Optional (v. 6):
    
    i386:
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    
    x86_64:
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-lock-sanlock-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux HPC Node (v. 6):
    
    Source:
    libvirt-0.10.2-64.el6_10.2.src.rpm
    
    x86_64:
    libvirt-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-python-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux HPC Node Optional (v. 6):
    
    x86_64:
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-lock-sanlock-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux Server (v. 6):
    
    Source:
    libvirt-0.10.2-64.el6_10.2.src.rpm
    
    i386:
    libvirt-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-python-0.10.2-64.el6_10.2.i686.rpm
    
    ppc64:
    libvirt-0.10.2-64.el6_10.2.ppc64.rpm
    libvirt-client-0.10.2-64.el6_10.2.ppc.rpm
    libvirt-client-0.10.2-64.el6_10.2.ppc64.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.ppc.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.ppc64.rpm
    libvirt-devel-0.10.2-64.el6_10.2.ppc.rpm
    libvirt-devel-0.10.2-64.el6_10.2.ppc64.rpm
    libvirt-python-0.10.2-64.el6_10.2.ppc64.rpm
    
    s390x:
    libvirt-0.10.2-64.el6_10.2.s390x.rpm
    libvirt-client-0.10.2-64.el6_10.2.s390.rpm
    libvirt-client-0.10.2-64.el6_10.2.s390x.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.s390.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.s390x.rpm
    libvirt-devel-0.10.2-64.el6_10.2.s390.rpm
    libvirt-devel-0.10.2-64.el6_10.2.s390x.rpm
    libvirt-python-0.10.2-64.el6_10.2.s390x.rpm
    
    x86_64:
    libvirt-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-python-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux Server Optional (v. 6):
    
    x86_64:
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-lock-sanlock-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux Workstation (v. 6):
    
    Source:
    libvirt-0.10.2-64.el6_10.2.src.rpm
    
    i386:
    libvirt-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-python-0.10.2-64.el6_10.2.i686.rpm
    
    x86_64:
    libvirt-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-client-0.10.2-64.el6_10.2.i686.rpm
    libvirt-client-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.i686.rpm
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-devel-0.10.2-64.el6_10.2.i686.rpm
    libvirt-devel-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-python-0.10.2-64.el6_10.2.x86_64.rpm
    
    Red Hat Enterprise Linux Workstation Optional (v. 6):
    
    x86_64:
    libvirt-debuginfo-0.10.2-64.el6_10.2.x86_64.rpm
    libvirt-lock-sanlock-0.10.2-64.el6_10.2.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2019-10161
    https://access.redhat.com/security/updates/classification/#moderate
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXQuUsNzjgjWX9erEAQjU7A//XC+RqwLEWz3u+WCyn0qvBRQPZBUrCg0n
    bSDU8RGfe5CwbGP7K3LbCiZ83vdoSSMbGa5GNAoP6Lpnl3SsTXaE7yzFDUyzrT2s
    UGrIdJLgc/PJ0z9kyuNYbp+gz9y+xdGEYtGc6shYvrGws9Gyg1m3iHTHhxijcFyP
    dOp235V0KgmEzJpESz95etr+1S6ow0ezY94QPAHW0BqViQZsKBYAv+EDtY0/6JMi
    dNLZzEuJawkmt07RMYUj6qvo+LJlOOiObpPbR4+IOJrVSHypuuKfih8q60FO0kYL
    o3lnCEXE1gQjY+uzvuuwSLzxheSoRpb1lpXJdqRln6AElIjvzfkIIGAF/GiGhCQq
    OVfMfEIscAJppcE0BxJXME7/FCjpb4Xx8KPPLtBc3w2JZNah42IF8fgJKAw7YfRF
    fxrvT1YNUAZF4UzHU/XS49HoexAZq1yZVZdrZtRpNzsJ9SGkuhmo2yZ1hLcNv1pa
    BFZD9uw5+XO+v9Lm/EzPYlCeOqJ44uSbCk7UiRx8coWiZgA3ZUavGxOGlOkJBuc8
    ezAT8pXV85mQjUIzUtfXWSBbN3dCcJINO38kBSMJ8eu3qVTIeniK9GYYoKqS5U19
    LBLDjDvAsA26DCFRI4OxqMNk3mWjcqi+7U/nP7NaR7sHZEdiTwqU62n0PrV1qkQ4
    QEhfMDzykas=
    =d2Nn
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"15","type":"x","order":"1","pct":53.57,"resources":[]},{"id":"88","title":"Should be more technical","votes":"4","type":"x","order":"2","pct":14.29,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"9","type":"x","order":"3","pct":32.14,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.