UbuntuUpdates.org

Package "libvirt-daemon-system-sysv"

Name: libvirt-daemon-system-sysv

Description:

Libvirt daemon configuration files (sysv)
Latest version: 8.0.0-1ubuntu7.15
Release: jammy (22.04)
Level: security
Repository: universe
Head package: libvirt
Homepage: https://libvirt.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libvirt-daemon-system-sysv"

All arch deb package
APT INSTALL

Other versions of "libvirt-daemon-system-sysv" in Jammy

Repository Area Version
base universe 8.0.0-1ubuntu7
updates universe 8.0.0-1ubuntu7.15

Changelog

Version: 8.0.0-1ubuntu7.15 2026-01-08 15:09:42 UTC

  libvirt (8.0.0-1ubuntu7.15) jammy-security; urgency=medium

  * SECURITY UPDATE: memory consumption DoS via XML parsing
    - debian/patches/CVE-2025-12748-pre1.patch: move unlinking corrupt save
      image file to caller in src/qemu/qemu_driver.c,
      src/qemu/qemu_saveimage.c, src/qemu/qemu_saveimage.h,
      src/qemu/qemu_snapshot.c.
    - debian/patches/CVE-2025-12748-pre2.patch: decompose qemuSaveImageOpen
      in src/qemu/qemu_driver.c, src/qemu/qemu_saveimage.c,
      src/qemu/qemu_saveimage.h, src/qemu/qemu_snapshot.c
    - debian/patches/CVE-2025-12748-pre3.patch: check for valid save image
      format when verifying image header in src/qemu/qemu_saveimage.c.
    - debian/patches/CVE-2025-12748-1.patch: add virDomainDefIDsParseString
      in src/conf/domain_conf.c, src/conf/domain_conf.h,
      src/libvirt_private.syms.
    - debian/patches/CVE-2025-12748-2.patch: check ACLs before parsing the
      whole domain XML in src/bhyve/bhyve_driver.c.
    - debian/patches/CVE-2025-12748-3.patch: check ACLs before parsing the
      whole domain XML in src/libxl/libxl_driver.c,
    - debian/patches/CVE-2025-12748-4.patch: check ACLs before parsing the
      whole domain XML in src/lxc/lxc_driver.c.
    - debian/patches/CVE-2025-12748-5.patch: check ACLs before parsing the
      whole domain XML in src/vz/vz_driver.c.
    - debian/patches/CVE-2025-12748-6.patch: check ACLs before parsing the
      whole domain XML in src/ch/ch_driver.c.
    - debian/patches/CVE-2025-12748-7.patch: check ACLs before parsing the
      whole domain XML in src/qemu/qemu_driver.c,
      src/qemu/qemu_migration.c, src/qemu/qemu_migration.h,
      src/qemu/qemu_saveimage.c, src/qemu/qemu_saveimage.h,
      src/qemu/qemu_snapshot.c.
    - debian/patches/CVE-2025-12748-8.patch: fix typo in bhyve driver in
      src/bhyve/bhyve_driver.c.
    - CVE-2025-12748
  * SECURITY UPDATE: incorrect world-readable permissions on snapshots
    - debian/patches/CVE-2025-13193.patch: set umask for qemu-img when
      creating external inactive snapshots in src/qemu/qemu_snapshot.c.
    - CVE-2025-13193

 -- Marc Deslauriers <email address hidden> Mon, 08 Dec 2025 13:08:06 -0500
Source diff to previous version
CVE-2025-12748 A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL c
CVE-2025-13193 A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivil

Version: 8.0.0-1ubuntu7.10 2024-04-15 18:07:06 UTC

  libvirt (8.0.0-1ubuntu7.10) jammy-security; urgency=medium

  * SECURITY UPDATE: off-by-one in udevListInterfacesByStatus()
    - debian/patches/CVE-2024-1441.patch: properly check count in
      src/interface/interface_backend_udev.c.
    - CVE-2024-1441
  * SECURITY UPDATE: crash in RPC library
    - debian/patches/CVE-2024-2494.patch: check values in
      src/remote/remote_daemon_dispatch.c, src/rpc/gendispatch.pl.
    - CVE-2024-2494
  * SECURITY UPDATE: null pointer deref in udevConnectListAllInterfaces()
    - debian/patches/CVE-2024-2496.patch: fix udev_device_get_sysattr_value
      return value check in src/interface/interface_backend_udev.c.
    - CVE-2024-2496

 -- Marc Deslauriers <email address hidden> Fri, 12 Apr 2024 13:48:21 -0400
Source diff to previous version
CVE-2024-1441 An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `nam
CVE-2024-2494 A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length c
CVE-2024-2496 A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host inter

Version: 8.0.0-1ubuntu7.5 2023-05-31 13:07:32 UTC

  libvirt (8.0.0-1ubuntu7.5) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via nwfilter driver
    - debian/patches/CVE-2022-0897.patch: fix crash when counting number of
      network filters in src/nwfilter/nwfilter_driver.c.
    - CVE-2022-0897
  * SECURITY UPDATE: DoS via memleak in SR-IOV PCI device capabilities
    - debian/patches/CVE-2023-2700.patch: resolve leak in
      virPCIVirtualFunctionList cleanup in src/util/virpci.c.
    - CVE-2023-2700

 -- Marc Deslauriers <email address hidden> Fri, 26 May 2023 10:08:33 -0400
CVE-2022-0897 A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before i
CVE-2023-2700 A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory


About   -   Send Feedback to @ubuntu_updates