SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:0304-1)

Low Nessus Plugin ID 88560


The remote SUSE host is missing one or more security updates.


libvirt was updated to fix one security issue and several non-security issues.

This security issue was fixed :

- CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

- CVE-2015-5313: path traversal vulnerability allowed libvirtd process to write arbitrary files into file system using root permissions (bsc#953110)

Theses non-security issues were fixed :

- bsc#948686: Use PAUSED state for domains that are starting up.

- bsc#903757: Provide nodeGetSecurityModel implementation in libxl.

- bsc#938228: Set disk type to BLOCK when driver is not tap or file.

- bsc#948516: Fix profile_status to distinguish between errors and unconfined domains.

- bsc#936524: Fix error starting lxc containers with direct interfaces.

- bsc#921555: Fixed apparmor generated profile for PCI hostdevs.

- bsc#899334: Include additional upstream fixes for systemd TerminateMachine.

- bsc#921586: Fix security driver default settings in /etc/libvirt/qemu.conf.

- bsc#921355: Fixed a number of QEMU apparmor abstraction problems.

- bsc#911737: Additional fix for the case where security labels aren't automatically set.

- bsc#914297: Allow setting the URL of an SMT server to use in place of SCC.

- bsc#904432: Backported route definition changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12 :

zypper in -t patch SUSE-SLE-WE-12-2016-189=1

SUSE Linux Enterprise Software Development Kit 12 :

zypper in -t patch SUSE-SLE-SDK-12-2016-189=1

SUSE Linux Enterprise Server for SAP 12 :

zypper in -t patch SUSE-SLE-SAP-12-2016-189=1

SUSE Linux Enterprise Server 12 :

zypper in -t patch SUSE-SLE-SERVER-12-2016-189=1

SUSE Linux Enterprise Desktop 12 :

zypper in -t patch SUSE-SLE-DESKTOP-12-2016-189=1

To bring your system up-to-date, use 'zypper patch'.

See Also

Plugin Details

Severity: Low

ID: 88560

File Name: suse_SU-2016-0304-1.nasl

Version: $Revision: 2.7 $

Type: local

Agent: unix

Published: 2016/02/03

Modified: 2016/12/27

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C


Base Score: 2.5

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libvirt, p-cpe:/a:novell:suse_linux:libvirt-client, p-cpe:/a:novell:suse_linux:libvirt-client-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon, p-cpe:/a:novell:suse_linux:libvirt-daemon-config-network, p-cpe:/a:novell:suse_linux:libvirt-daemon-config-nwfilter, p-cpe:/a:novell:suse_linux:libvirt-daemon-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-interface, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-interface-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-libxl, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-libxl-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-lxc, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-lxc-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-network, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-network-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-nodedev, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-nodedev-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-nwfilter, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-nwfilter-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-qemu, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-qemu-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-secret, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-secret-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-storage, p-cpe:/a:novell:suse_linux:libvirt-daemon-driver-storage-debuginfo, p-cpe:/a:novell:suse_linux:libvirt-daemon-lxc, p-cpe:/a:novell:suse_linux:libvirt-daemon-qemu, p-cpe:/a:novell:suse_linux:libvirt-daemon-xen, p-cpe:/a:novell:suse_linux:libvirt-debugsource, p-cpe:/a:novell:suse_linux:libvirt-doc, p-cpe:/a:novell:suse_linux:libvirt-lock-sanlock, p-cpe:/a:novell:suse_linux:libvirt-lock-sanlock-debuginfo, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/02/01

Reference Information

CVE: CVE-2015-0236, CVE-2015-5313

BID: 72526

OSVDB: 117504, 131656