Scientific Linux: 2012-06-20 Low: Libvirt Security Update for i386/x86_64

Date: Mon, 9 Jul 2012 10:04:59 -0500
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: Security Errata for Scientific Linux
 
From: Patrick Riehecky 
Subject: Security ERRATA Low: libvirt on SL6.x i386/x86_64
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.

Synopsis: Low: libvirt security, bug fix, and enhancement update
Issue Date: 2012-06-20
CVE Numbers: CVE-2012-2693

The libvirt library is a C API for managing and interacting with the
virtualization capabilities of Linux and other operating systems. In
addition, libvirt provides tools for remote management of virtualized
systems.

Bus and device IDs were ignored when attempting to attach multiple USB
devices with identical vendor or product IDs to a guest. This could result
in the wrong device being attached to a guest, giving that guest root
access to the device. (CVE-2012-2693)

These updated libvirt packages include numerous bug fixes and enhancements.

All users of libvirt are advised to upgrade to these updated packages,
which fix these issues and add these enhancements. After installing the
updated packages, libvirtd must be restarted ("service libvirtd restart")
for this update to take effect.

SL6:
 i386
 libvirt-0.9.10-21.el6.i686.rpm
 libvirt-client-0.9.10-21.el6.i686.rpm
 libvirt-debuginfo-0.9.10-21.el6.i686.rpm
 libvirt-devel-0.9.10-21.el6.i686.rpm
 libvirt-lock-sanlock-0.9.10-21.el6.i686.rpm
 libvirt-python-0.9.10-21.el6.i686.rpm
 x86_64
 libvirt-0.9.10-21.el6.x86_64.rpm
 libvirt-client-0.9.10-21.el6.i686.rpm
 libvirt-client-0.9.10-21.el6.x86_64.rpm
 libvirt-debuginfo-0.9.10-21.el6.i686.rpm
 libvirt-debuginfo-0.9.10-21.el6.x86_64.rpm
 libvirt-devel-0.9.10-21.el6.i686.rpm
 libvirt-devel-0.9.10-21.el6.x86_64.rpm
 libvirt-lock-sanlock-0.9.10-21.el6.x86_64.rpm
 libvirt-python-0.9.10-21.el6.x86_64.rpm

- Scientific Linux Development Team