util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles     the holding of a monitor job during a query to a guest     agent, which allows attackers to cause a denial of     service (API blockage).(CVE-2019-20485)

  - It was discovered that libvirtd before versions 4.10.1     and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an     arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with     access to the libvirtd socket could use this to probe     the existence of arbitrary files, cause denial of     service or cause libvirtd to execute arbitrary     programs.(CVE-2019-10161)

  - The virConnectGetDomainCapabilities() libvirt API,     versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an 'emulatorbin' argument to specify the     program providing emulation for a domain. Since     v1.2.19, libvirt will execute that program to probe the     domain's capabilities. Read-only clients could specify     an arbitrary path for this argument, causing libvirtd     to execute a crafted executable with its own     privileges.(CVE-2019-10167)

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default. (CVE-2019-3840)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.(CVE-2018-6764)

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a later upstream version:
libvirt (4.5.0). (BZ#1563169)

Security Fix(es) :

* libvirt: guest could inject executable code via libnss_dns.so loaded by libvirt_lxc before init (CVE-2018-6764)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Security Fix(es) :

  - libvirt: guest could inject executable code via     libnss_dns.so loaded by libvirt_lxc before init     (CVE-2018-6764)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3113 advisory.

    [4.5.0-10]
    - conf: correct false boot order error during domain parse (rhbz#1601318)

    [4.5.0-9]
    - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
    - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
    - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)

    [4.5.0-8]
    - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
    - access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
    - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)

    [4.5.0-7]
    - qemu_migration: Avoid writing to freed memory (rhbz#1593137)
    - qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618622)
    - tests: rename hugepages to hugepages-default (rhbz#1591235)
    - tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1591235)
    - tests: rename hugepages-numa into hugepages-numa-default (rhbz#1591235)
    - tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1591235)
    - tests: extract pages-discard out of hugepages-pages (rhbz#1591235)
    - tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1591235)
    - tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1591235)
    - tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1591235)
    - tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1591235)
    - tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1591235)
    - tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1591235)
    - tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1591235)
    - tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1591235)
    - tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1591235)
    - tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1591235)
    - tests: introduce hugepages-nodeset (rhbz#1591235)
    - conf: Move hugepage XML validation check out of qemu_command (rhbz#1591235)
    - conf: Move hugepages validation out of XML parser (rhbz#1591235)
    - conf: Introduce virDomainDefPostParseMemtune (rhbz#1591235)
    - tests: sev: Test launch-security with specific QEMU version (rhbz#1612009)
    - qemu: Fix probing of AMD SEV support (rhbz#1612009)
    - qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1612009)

    [4.5.0-6]
    - qemu: Exempt video model 'none' from getting a PCI address on Q35 (rhbz#1609087)
    - conf: Fix a error msg typo in virDomainVideoDefValidate (rhbz#1607825)

    [4.5.0-5]
    - esx storage: Fix typo lsilogic -> lsiLogic (rhbz#1571759)
    - networkGetDHCPLeases: Dont always report error if unable to read leases file (rhbz#1600468)
    - nwfilter: Resolve SEGV for NWFilter Snoop processing (rhbz#1599973)
    - qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs (rhbz#1589115)
    - qemuDomainSaveMemory: Dont enforce dynamicOwnership (rhbz#1589115)
    - domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl (rhbz#1607831)
    - examples: Add clean-traffic-gateway into nwfilters (rhbz#1603115)

    [4.5.0-4]
    - qemu: hotplug: dont overwrite error message in qemuDomainAttachNetDevice (rhbz#1598311)
    - qemu: hotplug: report error when changing rom enabled attr for net iface (rhbz#1599513)
    - qemu: Fix setting global_period cputune element (rhbz#1600427)
    - tests: qemucaps: Add test data for upcoming qemu 3.0.0 (rhbz#1475770)
    - qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend (rhbz#1475770)
    - qemu: command: Move graphics iteration to its own function (rhbz#1475770)
    - qemu: address: Handle all the video devices within a single loop (rhbz#1475770)
    - conf: Introduce virDomainVideoDefClear helper (rhbz#1475770)
    - conf: Introduce virDomainDefPostParseVideo helper (rhbz#1475770)
    - qemu: validate: Enforce compile time switch type checking for videos (rhbz#1475770)
    - tests: Add capabilities data for QEMU 2.11 x86_64 (rhbz#1475770)
    - tests: Update capabilities data for QEMU 3.0.0 x86_64 (rhbz#1475770)
    - qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc (rhbz#1475770)
    - qemu: caps: Introduce a capability for egl-headless (rhbz#1475770)
    - qemu: Introduce a new graphics display type 'headless' (rhbz#1475770)
    - qemu: caps: Add vfio-pci.display capability (rhbz#1475770)
    - conf: Introduce virDomainGraphicsDefHasOpenGL helper (rhbz#1475770)
    - conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys (rhbz#1475770)
    - conf: Introduce new <hostdev> attribute 'display' (rhbz#1475770)
    - qemu: command: Enable formatting vfio-pci.display option onto cmdline (rhbz#1475770)
    - docs: Rephrase the mediated devices hostdev section a bit (rhbz#1475770)
    - conf: Introduce new video type 'none' (rhbz#1475770)
    - virt-xml-validate: Add schema for nwfilterbinding (rhbz#1600330)
    - tools: Fix typo generating adapter_wwpn field (rhbz#1601377)
    - src: Fix memory leak in virNWFilterBindingDispose (rhbz#1603025)

    [4.5.0-3]
    - qemu: hotplug: Do not try to add secret object for TLS if it does not exist (rhbz#1598015)
    - qemu: monitor: Make qemuMonitorAddObject more robust against programming errors (rhbz#1598015)
    - spec: Explicitly require matching libvirt-libs (rhbz#1600122)
    - virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash (rhbz#1599545)
    - qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one (rhbz#1470007)
    - qemuDomainValidateStorageSource: Relax PR validation (rhbz#1470007)
    - virStoragePRDefFormat: Suppress path formatting for migratable XML (rhbz#1470007)
    - qemu: Wire up PR_MANAGER_STATUS_CHANGED event (rhbz#1470007)
    - qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo (rhbz#1470007)
    - qemu: Fetch pr-helper process info on reconnect (rhbz#1470007)
    - qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject (rhbz#1598015)
    - virsh.pod: Fix a command name typo in nwfilter-binding-undefine (rhbz#1600329)
    - docs: schema: Add missing <alias> to vsock device (rhbz#1600345)
    - virnetdevtap: Dont crash on !ifname in virNetDevTapInterfaceStats (rhbz#1595184)

    [4.5.0-2]
    - qemu: Add capability for the HTM pSeries feature (rhbz#1525599)
    - conf: Parse and format the HTM pSeries feature (rhbz#1525599)
    - qemu: Format the HTM pSeries feature (rhbz#1525599)
    - qemu: hotplug: Dont access srcPriv when its not allocated (rhbz#1597550)
    - qemuDomainNestedJobAllowed: Allow QEMU_JOB_NONE (rhbz#1598084)
    - src: Mention DEVICE_REMOVAL_FAILED event in virDomainDetachDeviceAlias docs (rhbz#1598087)
    - virsh.pod: Drop --persistent for detach-device-alias (rhbz#1598087)
    - qemu: dont use chardev FD passing with standalone args (rhbz#1598281)
    - qemu: remove chardevStdioLogd param from vhostuser code path (rhbz#1597940)
    - qemu: consolidate parameters of qemuBuildChrChardevStr into flags (rhbz#1597940)
    - qemu: dont use chardev FD passing for vhostuser backend (rhbz#1597940)
    - qemu: fix UNIX socket chardevs operating in client mode (rhbz#1598440)
    - qemuDomainDeviceDefValidateNetwork: Check for range only if IP prefix set (rhbz#1515533)

    [4.5.0-1]
    - Rebased to libvirt-4.5.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1291851, rhbz#1393106, rhbz#1468422, rhbz#1469338, rhbz#1526382         rhbz#1529059, rhbz#1541921, rhbz#1544869, rhbz#1552092, rhbz#1568407         rhbz#1583623, rhbz#1584091, rhbz#1585108, rhbz#1586027, rhbz#1588295         rhbz#1588336, rhbz#1589730, rhbz#1590214, rhbz#1591017, rhbz#1591561         rhbz#1591628, rhbz#1591645, rhbz#1593549

    [4.4.0-2]
    - build: Dont install sysconfig files as scripts (rhbz#1563169)

    [4.4.0-1]
    - Rebased to libvirt-4.4.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1149445, rhbz#1291851, rhbz#1300772, rhbz#1400475, rhbz#1456165         rhbz#1470007, rhbz#1480668, rhbz#1534418, rhbz#1549531, rhbz#1559284         rhbz#1559835, rhbz#1560946, rhbz#1566416, rhbz#1569861, rhbz#1572491         rhbz#1574089, rhbz#1576916, rhbz#1583484, rhbz#1583927, rhbz#1584071         rhbz#1584073

    [4.3.0-1]
    - Rebased to libvirt-4.3.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1509870, rhbz#1530451, rhbz#1577920, rhbz#1283700, rhbz#1425757         rhbz#1448149, rhbz#1454709, rhbz#1502754, rhbz#1507737, rhbz#1519130         rhbz#1519146, rhbz#1522706, rhbz#1523564, rhbz#1524399, rhbz#1525496         rhbz#1527740, rhbz#1550980, rhbz#916061, rhbz#1494454, rhbz#1515533         rhbz#1532542, rhbz#1538570, rhbz#1544325, rhbz#1544659, rhbz#1546971         rhbz#1347550, rhbz#1367238, rhbz#1483816, rhbz#1543775, rhbz#1551000         rhbz#1552127, rhbz#1553075, rhbz#1553085, rhbz#1554876, rhbz#1556828         rhbz#1558317, rhbz#1425058, rhbz#1490158, rhbz#1492597, rhbz#1520821         rhbz#1529256, rhbz#1547250, rhbz#1557769, rhbz#1560917, rhbz#1560976         rhbz#1568148, rhbz#1569678, rhbz#1576464

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3113 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    The following packages have been upgraded to a later upstream version: libvirt (4.5.0). (BZ#1563169)

    Security Fix(es):

    * libvirt: guest could inject executable code via libnss_dns.so loaded by libvirt_lxc before init     (CVE-2018-6764)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt and virt-manager fixes the following issues :

Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625).

Non-security issues fixed in libvirt :

  - bsc#1070615: Fixed TPM device passthrough failure on     kernels >= 4.0.

  - bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted     to pvhvm. Unless vm memory is on gig boundary, vm won't     boot.

  - bsc#1082161: Unable to change RTC basis or adjustment     for Xen HVM guests using libvirt.

Non-security issues fixed in virt-manager :

  - bsc#1086038: VM guests cannot be properly installed with     virt-install

  - bsc#1067018: KVM Guest creation failed - Property .cmt     not found

  - bsc#1054986: Fix openSUSE 15.0 detection. It has no     content file or .treeinfo file

  - bsc#1085757: Fallback to latest version of openSUSE when     opensuse-unknown is detected for the ISO

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libvirt and virt-manager fixes the following issues:
Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625). Non-security issues fixed in     libvirt :

  - bsc#1070615: Fixed TPM device passthrough failure on     kernels >= 4.0.

  - bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted     to pvhvm. Unless vm memory is on gig boundary, vm won't     boot.

  - bsc#1082161: Unable to change RTC basis or adjustment     for Xen HVM guests using libvirt. Non-security issues     fixed in virt-manager :

  - bsc#1086038: VM guests cannot be properly installed with     virt-install

  - bsc#1067018: KVM Guest creation failed - Property .cmt     not found

  - bsc#1054986: Fix openSUSE 15.0 detection. It has no     content file or .treeinfo file

  - bsc#1085757: Fallback to latest version of openSUSE when     opensuse-unknown is detected for the ISO

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201804-07 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local privileged attacker could execute arbitrary commands or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libvirt fixes the following issues: Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625). Non-security issues fixed :

  - Error starting domain: internal error: No usable sysfs     TPM cancel file could be found (bsc#1078808).

  - SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm.
    Unless vm memory is on gig boundary, vm won't boot     (bsc#1082041).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Libvirt, a virtualisation abstraction library :

  - CVE-2018-1064     Daniel Berrange discovered that the QEMU guest agent     performed insufficient validation of incoming data,     which allows a privileged user in the guest to exhaust     resources on the virtualisation host, resulting in     denial of service.

  - CVE-2018-5748     Daniel Berrange and Peter Krempa discovered that the     QEMU monitor was susceptible to denial of service by     memory exhaustion. This was already fixed in Debian     stretch and only affects Debian jessie.

  - CVE-2018-6764     Pedro Sampaio discovered that LXC containers detected     the hostname insecurely. This only affects Debian     stretch.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3576-1 advisory.

    Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password     authentication when the VNC password was set to an empty string. A remote attacker could possibly use this     issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2016-5008)

    Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     17.10. (CVE-2017-1000256)

    Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An     attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service.
    (CVE-2018-5748)

    Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a     libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
141658	EulerOS Virtualization 3.0.2.2 : libvirt (EulerOS-SA-2020-2209)	Nessus	Huawei Local Security Checks	high
124959	EulerOS Virtualization 3.0.1.0 : libvirt (EulerOS-SA-2019-1456)	Nessus	Huawei Local Security Checks	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	high
124441	EulerOS 2.0 SP3 : libvirt (EulerOS-SA-2019-1314)	Nessus	Huawei Local Security Checks	high
123618	EulerOS 2.0 SP5 : libvirt (EulerOS-SA-2019-1144)	Nessus	Huawei Local Security Checks	high
123592	EulerOS 2.0 SP2 : libvirt (EulerOS-SA-2019-1118)	Nessus	Huawei Local Security Checks	high
119788	Amazon Linux 2 : libvirt (ALAS-2018-1134)	Nessus	Amazon Linux Local Security Checks	high
119692	CentOS 7 : libvirt (CESA-2018:3113)	Nessus	CentOS Local Security Checks	high
119193	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118773	Oracle Linux 7 : libvirt (ELSA-2018-3113)	Nessus	Oracle Linux Local Security Checks	high
118530	RHEL 7 : libvirt (RHSA-2018:3113)	Nessus	Red Hat Local Security Checks	high
117585	EulerOS Virtualization 2.5.0 : libvirt (EulerOS-SA-2018-1277)	Nessus	Huawei Local Security Checks	high
117562	EulerOS Virtualization 2.5.1 : libvirt (EulerOS-SA-2018-1253)	Nessus	Huawei Local Security Checks	high
109020	openSUSE Security Update : libvirt (openSUSE-2018-358) (Spectre)	Nessus	SuSE Local Security Checks	high
109012	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0920-1) (Spectre)	Nessus	SuSE Local Security Checks	high
108928	GLSA-201804-07 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
108827	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0861-1) (Spectre)	Nessus	SuSE Local Security Checks	high
108346	Debian DSA-4137-1 : libvirt - security update	Nessus	Debian Local Security Checks	high
106928	Ubuntu 14.04 LTS / 16.04 LTS : libvirt vulnerabilities (USN-3576-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2018-6764

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical