From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4137-1
[email protected] https://www.debian.org/security/ Moritz Muehlenhoff
March 14, 2018
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libvirt
CVE ID : CVE-2018-1064 CVE-2018-5748 CVE-2018-6764
Several vulnerabilities were discovered in Libvirt, a virtualisation abstraction library:
CVE-2018-1064
Denial Berrange discovered that the QEMU guest agent performed
insufficient validationof incoming data, which allows a privileged
user in the guest to exhaust resources on the virtualisation host,
resulting in denial of service.
CVE-2018-5748
Daniel Berrange and Peter Krempa that the QEMU monitor was suspectible
to denial of service by memory exhaustion. This was already fixed in
Debian stretch and only affects Debian jessie.
CVE-2018-6764
Pedro Sampaio discovered that LXC containes detected the hostname
insecurely. This only affects Debian stretch.
For the oldstable distribution (jessie), these problems have been fixed
in version 1.2.9-9+deb8u5.
For the stable distribution (stretch), these problems have been fixed in version 3.0.0-4+deb9u3.
We recommend that you upgrade your libvirt packages.
For the detailed security status of libvirt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libvirt
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
[email protected]
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlqpl6wACgkQEMKTtsN8 Tjb6qw/+MeW4HJxYNAaOyU4h4hCXgPOonjHvoveKaGzKqxiNbw9x7bWFA9dxu+yA X4TWc91LHKhAXpvvet9qkr/IAOjHAy0Vy4GR8tUuaDyJ3VD5B+KX16rYd1r7loDG 2Cc/70YAxPn9p24ZUhHdEf4XOVj/3di6UWi2VxI6LsW4Ih5rpG5Ka+Vj6/zQVOKn QAqXkiQf1fB1A9jUvl4jZ0TxyCe8mCp6xKyZpdw0MBtMfJ9APa6FosWhzjXy51Pw vRmdZ33CLREd9IINw4vtgA1AnGCTJKwrQC8Pb6vhj2ukRgSRYJoIiZX2yNyULtXo LwsIiGnvalqGF17NnkfJYsve04twMyqwvr+0xb5kU+CmmbmjJBJ0crYm+TfnTHrA f+tI/zdr59BLVDD+YucEsDtXnoyy9xtJ4rvZE1G3SqM+qJSQNLsi+TAjQDkFaBOO 9dGG+mG8Omk3Y7UgazU69iT4Pg7DpF3DNG7jjhbJSKSfLXyo/Y842ySqSnzJTP3j fCVg5G7dNDGBSHuSMIL3/T6+htJBdeKEdXamB912/fYa0lphpKhPYTvEeiHZYnGb qzUzMpazmlpw1MmBZCCxFcPxK8vBYR5NNZewPd08QPaDHKsnyqG9ZI9zIuixsuF4 RQZJGxnvh9juPiBTaffkgdNm3bVWVI9mxvWhreZN3tK11lNZdC8=
=evCW
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)