rpm package
suse/libvirt&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1
pkg:rpm/suse/libvirt&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1
Vulnerabilities (12)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-10167 | — | < 1.2.18.4-22.13.1 | 1.2.18.4-22.13.1 | Aug 2, 2019 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. | ||
| CVE-2019-10161 | — | < 1.2.18.4-22.13.1 | 1.2.18.4-22.13.1 | Jul 30, 2019 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirt | ||
| CVE-2018-12130 | — | < 1.2.18.4-22.10.1 | 1.2.18.4-22.10.1 | May 30, 2019 | Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h | ||
| CVE-2018-12127 | — | < 1.2.18.4-22.10.1 | 1.2.18.4-22.10.1 | May 30, 2019 | Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: | ||
| CVE-2018-12126 | — | < 1.2.18.4-22.10.1 | 1.2.18.4-22.10.1 | May 30, 2019 | Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found | ||
| CVE-2019-11091 | — | < 1.2.18.4-22.10.1 | 1.2.18.4-22.10.1 | May 30, 2019 | Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c | ||
| CVE-2018-3639 | — | < 1.2.18.4-22.3.1 | 1.2.18.4-22.3.1 | May 22, 2018 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka | ||
| CVE-2018-1064 | — | < 1.2.18.4-22.3.1 | 1.2.18.4-22.3.1 | Mar 28, 2018 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. | ||
| CVE-2018-5748 | — | < 1.2.18.4-22.3.1 | 1.2.18.4-22.3.1 | Jan 25, 2018 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. | ||
| CVE-2017-5715 | — | < 1.2.18.4-22.3.1 | 1.2.18.4-22.3.1 | Jan 4, 2018 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | ||
| CVE-2016-5008 | Cri | 9.8 | < 1.2.18.4-11.7 | 1.2.18.4-11.7 | Jul 13, 2016 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. | |
| CVE-2015-5313 | Low | 2.5 | < 1.2.18.2-8.1 | 1.2.18.2-8.1 | Apr 11, 2016 | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write t |
- CVE-2019-10167Aug 2, 2019affected < 1.2.18.4-22.13.1fixed 1.2.18.4-22.13.1
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities.
- CVE-2019-10161Jul 30, 2019affected < 1.2.18.4-22.13.1fixed 1.2.18.4-22.13.1
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirt
- CVE-2018-12130May 30, 2019affected < 1.2.18.4-22.10.1fixed 1.2.18.4-22.10.1
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found h
- CVE-2018-12127May 30, 2019affected < 1.2.18.4-22.10.1fixed 1.2.18.4-22.10.1
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:
- CVE-2018-12126May 30, 2019affected < 1.2.18.4-22.10.1fixed 1.2.18.4-22.10.1
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found
- CVE-2019-11091May 30, 2019affected < 1.2.18.4-22.10.1fixed 1.2.18.4-22.10.1
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products c
- CVE-2018-3639May 22, 2018affected < 1.2.18.4-22.3.1fixed 1.2.18.4-22.3.1
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka
- CVE-2018-1064Mar 28, 2018affected < 1.2.18.4-22.3.1fixed 1.2.18.4-22.3.1
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.
- CVE-2018-5748Jan 25, 2018affected < 1.2.18.4-22.3.1fixed 1.2.18.4-22.3.1
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
- CVE-2017-5715Jan 4, 2018affected < 1.2.18.4-22.3.1fixed 1.2.18.4-22.3.1
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
- affected < 1.2.18.4-11.7fixed 1.2.18.4-11.7
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
- affected < 1.2.18.2-8.1fixed 1.2.18.2-8.1
Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write t