| From: |
| updates@fedoraproject.org |
| To: |
| package-announce@lists.fedoraproject.org |
| Subject: |
| [SECURITY] Fedora 19 Update: libvirt-1.0.5.6-2.fc19 |
| Date: |
| Wed, 02 Oct 2013 06:41:24 +0000 |
| Message-ID: |
| <20131002064125.E66BB21646@bastion01.phx2.fedoraproject.org> |
| Archive-link: |
| Article, Thread
|
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-17618
2013-09-26 04:49:04
--------------------------------------------------------------------------------
Name : libvirt
Product : Fedora 19
Version : 1.0.5.6
Release : 2.fc19
URL : http://libvirt.org/
Summary : Library providing a simple virtualization API
Description :
Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). The main package includes
the libvirtd server exporting the virtualization support.
--------------------------------------------------------------------------------
Update Information:
* Fix snapshot restore when VM has disabled usb support (bz #1011520)
* Rebased to version 1.0.5.6
* Fix blockjobinfo python API (bz #999077)
* CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332)
* CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667)
* CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511)
* CVE-2013-5651: virBitmapParse out-of-bounds (bz #1006493)
* Fix virsh change-media with block disk type (bz #951192)
* Fix changing VNC listen address (bz #1006697)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 24 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.6-2
- Fix snapshot restore when VM has disabled usb support (bz #1011520)
* Fri Sep 20 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.6-1
- Rebased to version 1.0.5.6
- Fix blockjobinfo python API (bz #999077)
- CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332)
- CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667)
- CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511)
- CVE-2013-5651: virBitmapParse out-of-bounds (bz #1006493)
- Fix virsh change-media with block disk type (bz #951192)
- Fix changing VNC listen address (bz #1006697)
* Thu Aug 1 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.5-1
- Rebased to version 1.0.5.5
- Really fix /dev/tty inside a container (bz #982317)
- Fix possible deadlock from getpwuid_r (bz #964358)
* Fri Jul 12 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.4-1
- Rebased to version 1.0.5.4
- Fix crash on migration
* Thu Jul 11 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.3-1
- Rebased to version 1.0.5.3
- Allow /dev/tty in LXC container (bz #982317)
- Fix cpu hot-add with latest qemu (bz #979260)
- Fix crash in udev logging (bz #969152)
* Wed Jun 12 2013 Cole Robinson <crobinso@redhat.com> - 1.0.5.2-1
- Rebased to version 1.0.5.2
- Don't error if disk resize isn't multiple of 512 (bz #951495)
- Fix racey cgroup error at VM startup (bz #965169)
- Fix crash in nwfilter at daemon shutdown (bz #967740)
- Fix 'tray is locked' error on media eject (bz #967914)
- Error on invalid combo of --tunnelled and --copy-storage (bz #968043)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1005332 - CVE-2013-4311 libvirt: insecure calling of polkit
https://bugzilla.redhat.com/show_bug.cgi?id=1005332
[ 2 ] Bug #1006173 - CVE-2013-4296 libvirt: invalid free in remoteDispatchDomainMemoryStats
https://bugzilla.redhat.com/show_bug.cgi?id=1006173
[ 3 ] Bug #1006509 - CVE-2013-4291 libvirt: supplementary groups not adjusted correctly when
parsing label
https://bugzilla.redhat.com/show_bug.cgi?id=1006509
[ 4 ] Bug #1006493 - CVE-2013-5651 libvirt: virBitmapParse out-of-bounds read access
https://bugzilla.redhat.com/show_bug.cgi?id=1006493
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update libvirt' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-...
(
Log in to post comments)
