Security update for libvirt (important)

An update that fixes four vulnerabilities is now available.

Description:

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could
  accept a path parameter pointing anywhere on the system and potentially
  leading to execution
  of a malicious file with root privileges by libvirtd (bsc#1138301).
• CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which
  could have been used to alter the domain’s config used for managedsave
  or execute arbitrary emulator binaries (bsc#1138302).
• CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API
  which could have been used to execute arbitrary emulators (bsc#1138303).
• CVE-2019-10168: Fixed an issue with virConnect*HypervisorCPU API which
  could have been used to execute arbitrary emulators (bsc#1138305).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.1:

  zypper in -t patch openSUSE-2019-1753=1