SUSE-SU-2019:1690-1

Details

Description of the patch:

This update for libvirt fixes the following issue:

Security issue fixed:

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

Affected Packages(19 packages)

libvirt

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-client

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-config-network

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-config-nwfilter

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-driver-interface

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-driver-libxl

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-driver-lxc

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-driver-network

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

libvirt-daemon-driver-nodedev

SUSE Linux Enterprise Server 12-LTSS

Fixed in:

1.2.5-27.19.1

References

ADVISORY

https://bugzilla.suse.com/1138301

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2019-June/005629.html

ADVISORY

https://www.suse.com/security/cve/CVE-2019-10161/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2019/suse-su-20191690-1/