MGASA-2019-0390: libvirt Mageia

Vulnerability summary

MGASA-2019-0390 is a vulnerability in libvirt Mageia with no CVSS score yet.

Timeline

1. 15-12-2019
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated libvirt packages fix security vulnerabilities Updated libvirt packages fix security vulnerabilities: An information leak which allowed to retrieve the guest hostname under readonly mode (CVE-2019-3886). Wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132). Arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161). virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166). Arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167). Arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168). Also, this update contains the libvirt adjustments, that pass through the new 'md-clear' CPU flag, to help address Intel CPU speculative execution flaws.

No weakness data has been published for this record.