– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Gentoo Linux Security Advisory GLSA 201412-04
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
http://security.gentoo.org/
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Severity: High
Title: libvirt: Multiple vulnerabilities
Date: December 08, 2014
Bugs: #483048, #484014, #485520, #487684, #489374, #494072,
#496204, #498534, #502232, #504996, #509858, #524184, #528440
ID: 201412-04

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Synopsis
========

Multiple vulnerabilities have been found in libvirt, worst of which
allows context-dependent attackers to escalate privileges.

Background
==========

libvirt is a C toolkit for manipulating virtual machines.

Affected packages
=================

——————————————————————-
Package / Vulnerable / Unaffected
——————————————————————-
1 app-emulation/libvirt < 1.2.9-r2 >= 1.2.9-r2

Description
===========

Multiple vulnerabilities have been discovered in libvirt. Please review
the CVE identifiers referenced below for details.

Impact
======

A remote attacker may be able to cause a Denial of Service or cause
information leakage. A local attacker may be able to escalate
privileges, cause a Denial of Service or possibly execute arbitrary
code.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All libvirt users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>=app-emulation/libvirt-1.2.9-r2”

References
==========

[ 1 ] CVE-2013-4292
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4292
[ 2 ] CVE-2013-4296
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4296
[ 3 ] CVE-2013-4297
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4297
[ 4 ] CVE-2013-4399
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4399
[ 5 ] CVE-2013-4400
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4400
[ 6 ] CVE-2013-4401
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4401
[ 7 ] CVE-2013-5651
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5651
[ 8 ] CVE-2013-6436
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6436
[ 9 ] CVE-2013-6456
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6456
[ 10 ] CVE-2013-6457
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6457
[ 11 ] CVE-2013-6458
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6458
[ 12 ] CVE-2013-7336
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7336
[ 13 ] CVE-2014-0028
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0028
[ 14 ] CVE-2014-0179
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0179
[ 15 ] CVE-2014-1447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1447
[ 16 ] CVE-2014-3633
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3633
[ 17 ] CVE-2014-5177
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5177
[ 18 ] CVE-2014-7823
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7823

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201412-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

—–BEGIN PGP SIGNATURE—–

iQIcBAEBCgAGBQJUhjPlAAoJEPw7F94F4TagUwcQALItTgo2bcFmWwxObHQGL8aE
ogDo+F32cS8PNoREwQFYbUBSVkER7iDnrAk16JsdaqEFx+QY0690j1Rb9fisZhZX
Lmcm1A7Egu0EmMWyvJ5Znf4FYfTCIOqQ/lh1j96sNhUEEdtUhf9zJQi1KmPN3Tkv
6CC/U741PfkcImnv7ucb51DSdssSBAj4b5kFBEQ0WVEcaBQTkMCVWtsidP7houES
nnkOUTy0vkQsgJm8Cbt/XM2l/WC0QJD17UqhOQHCYeB7sgivTekJ2Tt1pEBXUFI5
gHCnvGfqvH42T+CIGl8+x15EuHfo8I/YNu/5Ows0m5Yd3NIJWrb17SaRtMxPSS0s
T7Rm4yplhTEJ/bj7eGe5SvXfn3+Rj/ExtxDmfDe0d+QNgDdTrekMEmTfUGr4BOH/
WzLfebWi6O/KIn3I6zj/dpK451NXalW5SY/fpFBRxNFcPfDvagk7JKyIwdnqPyNT
O9y/dHTDpRoGIX/Tz+VIxz2KJP11LOu0mORCPSnURJH3Gi+Xe4JEMy38hDCyo4Uc
hRSfBhAGLDzKPJlXNbEFc5+YGZ5F4CAtPCWxrsO3scONQQXGq3CwvfRKwNSXWuA0
N6EN1uj5Hb89fiv2wNXWW22jybw5JXlxN/txR65dpMtzO/YMS3VGBFMzIkpimKgx
XBDUGRyUra+kDgK9Ga5c
=i/jo
—–END PGP SIGNATURE—–