Most recent entries from all

ALSA-2021:4191 — Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Affected: AlmaLinux:8: hivex, AlmaLinux:8: hivex-devel, AlmaLinux:8: libguestfs, AlmaLinux:8: libguestfs-bash-completion, AlmaLinux:8: libguestfs-benchmarking, AlmaLinux:8: libguestfs-devel, AlmaLinux:8: libguestfs-gfs2, AlmaLinux:8: libguestfs-gobject, AlmaLinux:8: libguestfs-gobject-devel, AlmaLinux:8: libguestfs-inspect-icons and 83 more

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

* QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

* QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

* QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

* QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

* QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

* libvirt: Insecure sVirt label generation (CVE-2021-3631)

* libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-05841

certfr-2024-avi-0380 — De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent…

certfr-2024-avi-0380

EUVD-2026-215975

fkie_cve-2021-3667

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

GHSA-q27q-h2jw-qq6c

gsd-2021-3667

msrc_CVE-2021-3667 — An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoo…

msrc_CVE-2021-3667

OESA-2021-1385 — libvirt security update

Affected: openEuler:20.03-LTS-SP1: libvirt, openEuler:20.03-LTS-SP2: libvirt

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es): An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.(CVE-2021-3667) A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.(CVE-2021-3631)

openSUSE-SU-2021:1451-1 — Security update for libvirt

Security update for libvirt

RHSA-2021:3703 — Red Hat Security Advisory: virt:av and virt-devel:av security and bug fix update

QEMU: net: Infinite loop in loopback mode may lead to stack overflow libvirt: Insecure sVirt label generation libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API QEMU: usbredir: free() call on invalid pointer in bufp_alloc() ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() ntfs-3g: Endless recursion from ntfs_attr_pw…

SUSE-SU-2021:2812-1 — Security update for libvirt

Security update for libvirt

UBUNTU-CVE-2021-3667

Affected: Ubuntu:20.04:LTS: libvirt, Ubuntu:22.04:LTS: libvirt

WID-SEC-W-2022-1728 — Red Enterprise Linux Advanced Virtualization: Mehrere Schwachstellen

Ein entfernter oder lokaler, authentisierter Angreifer kann mehrere Schwachstellen in Red Enterprise Linux Advanced Virtualization ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen und Informationen offenzulegen.