Bug 12920 - libvirt new security issue CVE-2013-6456
Summary: libvirt new security issue CVE-2013-6456
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/589092/
Whiteboard: MGA3TOO
Keywords:
Depends on: 13387
Blocks:
  Show dependency tree / graph
 
Reported: 2014-03-03 02:23 CET by David Walser
Modified: 2014-05-29 12:30 CEST (History)
1 user (show)

See Also:
Source RPM: libvirt-1.2.1-1.mga4.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-03-03 02:23:03 CET 
Upstream has released libvirt 1.2.2, fixing one security issue:
http://libvirt.org/news.html

Debian says the vulnerable code was introduced in 1.0.1, so Mageia 3 should be vulnerable too.  The commits to fix this in the 1.0.5 branch may help:
http://libvirt.org/git/?p=libvirt.git;a=shortlog;h=refs/heads/v1.0.5-maint

Reproducible: 

Steps to Reproduce:
David Walser 2014-03-03 02:23:12 CET

Whiteboard: (none) => MGA4TOO, MGA3TOO

Comment 1 David Walser 2014-03-03 19:03:23 CET 
Here's the upstream advisory:
http://security.libvirt.org/2013/0018.html

And the original bug report for this issue:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732394

I'm not sure from reading that if systems using systemd are vulnerable.
Comment 2 David Walser 2014-03-03 19:07:45 CET 
Fedora has issued an advisory for this on February 21:
https://lists.fedoraproject.org/pipermail/package-announce/2014-February/129199.html

URL: (none) => http://lwn.net/Vulnerabilities/589092/

Comment 3 David Walser 2014-03-15 19:56:09 CET 
Updated to 1.2.2 in Cauldron by Joseph Wang.

Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO
CC: (none) => joequant
Version: Cauldron => 4

Thomas Backlund 2014-05-18 09:43:31 CEST

Depends on: (none) => 13387

Comment 4 David Walser 2014-05-29 12:30:34 CEST 
Fixed in Bug 13387.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.