Lucene search

DebianDEBIAN:DLA-541-1:58ED7

HistoryJul 01, 2016 - 9:07 a.m.

[SECURITY] [DLA 541-1] libvirt security update

2016-07-0109:07:13

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.027

Percentile

90.6%

JSON

Package : libvirt
Version : 0.9.12.3-1+deb7u2
CVE ID : CVE-2016-5008

It was discovered that there was a password policy issue in libvirt, a
library for interfacing with different virtualization systems.

Setting an empty graphics password is documented as a way to disable
VNC/SPICE access, but QEMU does not always behave like that. VNC would
happily accept the empty password. We enforce the behavior by setting
password expiration to "now".

For Debian 7 "Wheezy", this issue has been fixed in libvirt version
0.9.12.3-1+deb7u2.

We recommend that you upgrade your libvirt packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-i386libvirt-clients< 1.2.9-9+deb8u3libvirt-clients_1.2.9-9+deb8u3_kfreebsd-i386.deb
Debian8mipslibvirt-bin< 1.2.9-9+deb8u3libvirt-bin_1.2.9-9+deb8u3_mips.deb
Debian8powerpclibvirt-daemon-system< 1.2.9-9+deb8u3libvirt-daemon-system_1.2.9-9+deb8u3_powerpc.deb
Debian8armhflibvirt-daemon< 1.2.9-9+deb8u3libvirt-daemon_1.2.9-9+deb8u3_armhf.deb
Debian8amd64libvirt-dev< 1.2.9-9+deb8u3libvirt-dev_1.2.9-9+deb8u3_amd64.deb
Debian8armhflibvirt0-dbg< 1.2.9-9+deb8u3libvirt0-dbg_1.2.9-9+deb8u3_armhf.deb
Debian8armhflibvirt-clients< 1.2.9-9+deb8u3libvirt-clients_1.2.9-9+deb8u3_armhf.deb
Debian8s390xlibvirt-dev< 1.2.9-9+deb8u3libvirt-dev_1.2.9-9+deb8u3_s390x.deb
Debian7i386libvirt0-dbg< 0.9.12.3-1+deb7u2libvirt0-dbg_0.9.12.3-1+deb7u2_i386.deb
Debian8i386libvirt-clients< 1.2.9-9+deb8u3libvirt-clients_1.2.9-9+deb8u3_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-i386	libvirt-clients	< 1.2.9-9+deb8u3	libvirt-clients_1.2.9-9+deb8u3_kfreebsd-i386.deb
Debian	8	mips	libvirt-bin	< 1.2.9-9+deb8u3	libvirt-bin_1.2.9-9+deb8u3_mips.deb
Debian	8	powerpc	libvirt-daemon-system	< 1.2.9-9+deb8u3	libvirt-daemon-system_1.2.9-9+deb8u3_powerpc.deb
Debian	8	armhf	libvirt-daemon	< 1.2.9-9+deb8u3	libvirt-daemon_1.2.9-9+deb8u3_armhf.deb
Debian	8	amd64	libvirt-dev	< 1.2.9-9+deb8u3	libvirt-dev_1.2.9-9+deb8u3_amd64.deb
Debian	8	armhf	libvirt0-dbg	< 1.2.9-9+deb8u3	libvirt0-dbg_1.2.9-9+deb8u3_armhf.deb
Debian	8	armhf	libvirt-clients	< 1.2.9-9+deb8u3	libvirt-clients_1.2.9-9+deb8u3_armhf.deb
Debian	8	s390x	libvirt-dev	< 1.2.9-9+deb8u3	libvirt-dev_1.2.9-9+deb8u3_s390x.deb
Debian	7	i386	libvirt0-dbg	< 0.9.12.3-1+deb7u2	libvirt0-dbg_0.9.12.3-1+deb7u2_i386.deb
Debian	8	i386	libvirt-clients	< 1.2.9-9+deb8u3	libvirt-clients_1.2.9-9+deb8u3_i386.deb