It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1580 advisory.

    - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
    - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
    - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
    - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)

    libvirt
    - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
    - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
    - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
    - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)

    qemu-kvm

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-18 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local privileged attacker could execute arbitrary commands, escalate       privileges or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the libvirt package has been released.

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
(CVE-2019-11091)

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

The virConnectGetDomainCapabilities() libvirt API accepts an 'emulatorbin' argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10167)

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. (CVE-2019-10166)

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.(CVE-2019-10132)

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs accept an 'emulator' argument to specify the program providing emulation for a domain.
Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10168)

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process.
An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. (CVE-2019-10161)

Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed: &#9; 

  - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API     which could accept a path parameter pointing anywhere on     the system and potentially leading to execution of a     malicious file with root privileges by libvirtd     (bsc#1138301). 

  - CVE-2019-10166: Fixed an issue with     virDomainManagedSaveDefineXML which could have been used     to alter the domain's config used for managedsave or     execute arbitrary emulator binaries (bsc#1138302).

  - CVE-2019-10167: Fixed an issue with     virConnectGetDomainCapabilities API which could have     been used to execute arbitrary emulators (bsc#1138303).

  - CVE-2019-10168: Fixed an issue with     virConnect*HypervisorCPU API which could have been used     to execute arbitrary emulators (bsc#1138305).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1762 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

    * libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

    * libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

    * libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4714 advisory.

    - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (Jan Tomko)  [Orabug: 29955742]     {CVE-2019-10161}
    - api: disallow virDomainManagedSaveDefineXML on read-only connections (Jan Tomko)  [Orabug: 29955742]     {CVE-2019-10166}
    - api: disallow virConnectGetDomainCapabilities on read-only connections (Jan Tomko)  [Orabug: 29955742]     {CVE-2019-10167}
    - api: disallow virConnect*HypervisorCPU on read-only connections (Jan Tomko)  [Orabug: 29955742]     {CVE-2019-10168}
    - cpu_map: Define md-clear CPUID bit (Jiri Denemark)  [Orabug: 29874181]       {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
    - logging: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}
    - locking: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4047-1 advisory.

    Matthias Gerstner and Jn Tomko discovered that libvirt incorrectly handled certain API calls. An     attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the     default installation, attackers would be isolated by the libvirt AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1699 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.3.4), redhat-virtualization-host (4.3.4). (BZ#1721058, BZ#1721062, BZ#1721065)

    Security Fix(es):

    * kernel: tcp: integer ovrtflow while processing SACK blocks allows remote denial of service     (CVE-2019-11477)

    * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

    * libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

    * libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

    * libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

    * Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service     (CVE-2019-11478)

    * kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of     service (CVE-2019-11479)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Cannot start VM with a CBR 2.0 TPM device (bz #1712556)

  - libvirtd does not update VM .xml configurations after     virsh snapshot/blockcommit (bz #1722348)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Failed to attache NEW rbd device to guest (bz #1672620)

  - PCI hostdev interface segfault (bz #1692053)

----

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

  - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API     which could accept a path parameter pointing anywhere on     the system and potentially leading to execution of a     malicious file with root privileges by libvirtd     (bsc#1138301).

  - CVE-2019-10166: Fixed an issue with     virDomainManagedSaveDefineXML which could have been used     to alter the domain's config used for managedsave or     execute arbitrary emulator binaries (bsc#1138302).

  - CVE-2019-10167: Fixed an issue with     virConnectGetDomainCapabilities API which could have     been used to execute arbitrary emulators (bsc#1138303).

Other issue addressed :

  - spec: add systemd-container dependency to qemu and lxc     drivers (bsc#1136109).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302).

CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303).

CVE-2019-10168: Fixed an issue with virConnect*HypervisorCPU API which could have been used to execute arbitrary emulators (bsc#1138305).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302).

CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303).

Other issue addressed: spec: add systemd-container dependency to qemu and lxc drivers (bsc#1136109).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302).

CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1579 advisory.

    - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
    - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
    - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
    - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Bug Fix(es) :

  - Live migration fail with unsafe error when GPFS is used     as shared filesystem

Security Fix(es) :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1580 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

    * libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

    * libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

    * libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1579 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

    * libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

    * libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

    * libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Live migration fail with unsafe error when GPFS is used as shared filesystem (BZ#1715867)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es) :

* libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

* libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

* libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

* libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Live migration fail with unsafe error when GPFS is used as shared filesystem (BZ#1715867)

ID	Name	Product	Family	Severity
180761	Oracle Linux 8 : virt:rhel (ELSA-2019-1580)	Nessus	Oracle Linux Local Security Checks	high
134595	GLSA-202003-18 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
130112	Photon OS 3.0: Libvirt PHSA-2019-3.0-0032	Nessus	PhotonOS Local Security Checks	high
128288	Amazon Linux 2 : libvirt (ALAS-2019-1274) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	high
128088	EulerOS 2.0 SP5 : libvirt (EulerOS-SA-2019-1796)	Nessus	Huawei Local Security Checks	high
127011	EulerOS 2.0 SP8 : libvirt (EulerOS-SA-2019-1774)	Nessus	Huawei Local Security Checks	high
126894	openSUSE Security Update : libvirt (openSUSE-2019-1753)	Nessus	SuSE Local Security Checks	high
126679	RHEL 8 : virt:8.0.0 (RHSA-2019:1762)	Nessus	Red Hat Local Security Checks	high
126674	Oracle Linux 7 : libvirt (ELSA-2019-4714)	Nessus	Oracle Linux Local Security Checks	high
126563	Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)	Nessus	Ubuntu Local Security Checks	high
126559	RHEL 7 : redhat-virtualization-host (RHSA-2019:1699)	Nessus	Red Hat Local Security Checks	high
126532	Fedora 30 : libvirt (2019-b2dfb13daf)	Nessus	Fedora Local Security Checks	high
126531	Fedora 29 : libvirt (2019-9210998aaa)	Nessus	Fedora Local Security Checks	high
126372	openSUSE Security Update : libvirt (openSUSE-2019-1672)	Nessus	SuSE Local Security Checks	high
126166	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1643-1)	Nessus	SuSE Local Security Checks	high
126165	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1637-1)	Nessus	SuSE Local Security Checks	high
126154	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2019:1599-1)	Nessus	SuSE Local Security Checks	high
126141	Oracle Linux 7 : libvirt (ELSA-2019-1579)	Nessus	Oracle Linux Local Security Checks	high
126091	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20190620)	Nessus	Scientific Linux Local Security Checks	high
126090	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20190620)	Nessus	Scientific Linux Local Security Checks	high
126088	RHEL 8 : virt:rhel (RHSA-2019:1580)	Nessus	Red Hat Local Security Checks	high
126087	RHEL 7 : libvirt (RHSA-2019:1579)	Nessus	Red Hat Local Security Checks	high
126076	CentOS 7 : libvirt (CESA-2019:1579)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2019-10166

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high