SUSE-SU-2025:4330-1

Advisory lineage Upstream: 6 Downstream: 0
Published: 09 Dec 2025, 11:33
Last modified:23 Mar 2026, 04:51

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Dec 2025, 11:33
Published
Vulnerability first disclosed
23 Mar 2026, 04:51
Last Modified
Vulnerability information updated

Description

Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Updated kubevirt to version 1.6.3: - CVE-2025-22872: Fixed incorrect interpretation of tags leading content to be placed wrong scope during DOM construction in golang.org/x/net/html (bsc#1241772) - CVE-2025-64432: Fixed bypass of RBAC controls due to incorrect validation of certain fields in the client TLS certificate (bsc#1253181) - CVE-2025-64433: Fixed arbitrary files read via improper symlink handling (bsc#1253185) - CVE-2025-64434: Fixed privilege escalation via virt-api impersonification due to compromise virt-handler instance (bsc#1253186) - CVE-2025-64437: Fixed mishandling of symlinks (bsc#1253194) - CVE-2025-64324: Fixed a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users (bsc#1253748)

Affected Systems

  • suse•kubevirt&distro=SUSE Linux Enterprise Module for Containers 15 SP7

    < 1.6.3-150700.3.13.1

References (15)