Multiple security issues in libvirt
Summary
DSA-2846-1: libvirt - several. Affects libvirt versions < 0.9.12.3-1. Fixed in 0.9.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libvirt is a virtualization abstraction library that provides a consistent API for managing various virtualization technologies. It allows applications to manage virtual machines, hypervisors, and other virtualization resources. Libvirt is widely used in the Debian ecosystem, specifically in Debian 7 (wheezy).
Vulnerability Detail
Two security vulnerabilities have been discovered in Libvirt:
-
CVE-2013-6458: Insecure job usage can lead to denial of service against libvirtd. This vulnerability could be exploited by an attacker to disrupt the functionality of libvirtd, potentially affecting the availability of virtualization services.
-
CVE-2014-1447: A race condition in keepalive handling can lead to denial of service against libvirtd. This vulnerability could be exploited by an attacker to cause libvirtd to crash or become unresponsive, impacting the availability of virtualization services.
How To Fix
Minimum fixed version
0.9.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the fixes by upgrading the libvirt packages.
Conclusion
Multiple security vulnerabilities have been discovered in libvirt, a virtualization abstraction library. These vulnerabilities can lead to denial of service against libvirtd, potentially impacting the availability of virtualization services. It is recommended to upgrade the libvirt packages to the fixed versions mentioned above. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libvirt →
FAQ
Libvirt is a virtualization abstraction library that provides a consistent API for managing various virtualization technologies.
CVE-2013-6458 can lead to denial of service against libvirtd, potentially affecting the availability of virtualization services.
CVE-2014-1447 can lead to denial of service against libvirtd, potentially causing it to crash or become unresponsive.
To fix these vulnerabilities, you need to upgrade the libvirt packages to the recommended versions.
You can upgrade the libvirt packages using the package manager of your Debian distribution.
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
