Home / mailings [SECURITY] [DSA 4137-1] libvirt security update
Posted on 14 March 2018
Debian Security Advisory-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4137-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
March 14, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libvirt
CVE ID : CVE-2018-1064 CVE-2018-5748 CVE-2018-6764
Several vulnerabilities were discovered in Libvirt, a virtualisation
abstraction library:
CVE-2018-1064
Denial Berrange discovered that the QEMU guest agent performed
insufficient validationof incoming data, which allows a privileged
user in the guest to exhaust resources on the virtualisation host,
resulting in denial of service.
CVE-2018-5748
Daniel Berrange and Peter Krempa that the QEMU monitor was suspectible
to denial of service by memory exhaustion. This was already fixed in
Debian stretch and only affects Debian jessie.
CVE-2018-6764
Pedro Sampaio discovered that LXC containes detected the hostname
insecurely. This only affects Debian stretch.
For the oldstable distribution (jessie), these problems have been fixed
in version 1.2.9-9+deb8u5.
For the stable distribution (stretch), these problems have been fixed in
version 3.0.0-4+deb9u3.
We recommend that you upgrade your libvirt packages.
For the detailed security status of libvirt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libvirt
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
