Lucene search

K
mageiaGentoo FoundationMGASA-2014-0401
HistoryOct 07, 2014 - 1:22 p.m.

Updated libvirt packages fix security vulnerbilities

2014-10-0713:22:51
Gentoo Foundation
advisories.mageia.org
32

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

EPSS

0.039

Percentile

92.0%

Updated libvirt packages fix security vulnerabilities: An out-of-bounds read flaw was found in the way libvirt’s qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633). A denial of service flaw was found in the way libvirt’s virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchlibvirt< 1.0.2-8.6libvirt-1.0.2-8.6.mga3
Mageia4noarchlibvirt< 1.2.1-1.2libvirt-1.2.1-1.2.mga4

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

EPSS

0.039

Percentile

92.0%