This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303).

Non-security issues fixed: Fixed an issue with short bitmaps when setting vcpu affinity using the vcpupin (bsc#1138734).

Added support for overriding max threads per process limit (bsc#1133719)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:2227-1)

high Nessus Plugin ID 128312

Version 1.4