Package "libnss-libvirt"

  libvirt (8.0.0-1ubuntu7.15) jammy-security; urgency=medium

  * SECURITY UPDATE: memory consumption DoS via XML parsing
    - debian/patches/CVE-2025-12748-pre1.patch: move unlinking corrupt save
      image file to caller in src/qemu/qemu_driver.c,
      src/qemu/qemu_saveimage.c, src/qemu/qemu_saveimage.h,
      src/qemu/qemu_snapshot.c.
    - debian/patches/CVE-2025-12748-pre2.patch: decompose qemuSaveImageOpen
      in src/qemu/qemu_driver.c, src/qemu/qemu_saveimage.c,
      src/qemu/qemu_saveimage.h, src/qemu/qemu_snapshot.c
    - debian/patches/CVE-2025-12748-pre3.patch: check for valid save image
      format when verifying image header in src/qemu/qemu_saveimage.c.
    - debian/patches/CVE-2025-12748-1.patch: add virDomainDefIDsParseString
      in src/conf/domain_conf.c, src/conf/domain_conf.h,
      src/libvirt_private.syms.
    - debian/patches/CVE-2025-12748-2.patch: check ACLs before parsing the
      whole domain XML in src/bhyve/bhyve_driver.c.
    - debian/patches/CVE-2025-12748-3.patch: check ACLs before parsing the
      whole domain XML in src/libxl/libxl_driver.c,
    - debian/patches/CVE-2025-12748-4.patch: check ACLs before parsing the
      whole domain XML in src/lxc/lxc_driver.c.
    - debian/patches/CVE-2025-12748-5.patch: check ACLs before parsing the
      whole domain XML in src/vz/vz_driver.c.
    - debian/patches/CVE-2025-12748-6.patch: check ACLs before parsing the
      whole domain XML in src/ch/ch_driver.c.
    - debian/patches/CVE-2025-12748-7.patch: check ACLs before parsing the
      whole domain XML in src/qemu/qemu_driver.c,
      src/qemu/qemu_migration.c, src/qemu/qemu_migration.h,
      src/qemu/qemu_saveimage.c, src/qemu/qemu_saveimage.h,
      src/qemu/qemu_snapshot.c.
    - debian/patches/CVE-2025-12748-8.patch: fix typo in bhyve driver in
      src/bhyve/bhyve_driver.c.
    - CVE-2025-12748
  * SECURITY UPDATE: incorrect world-readable permissions on snapshots
    - debian/patches/CVE-2025-13193.patch: set umask for qemu-img when
      creating external inactive snapshots in src/qemu/qemu_snapshot.c.
    - CVE-2025-13193

 -- Marc Deslauriers <email address hidden> Mon, 08 Dec 2025 13:08:06 -0500

  libvirt (8.0.0-1ubuntu7.14) jammy; urgency=medium

  * d/p/u-aa/lp2120278-* : virt-aa-helper: Avoid duplicate when append rule
    (LP: #2120278)

 -- Hector Cao <email address hidden> Tue, 14 Oct 2025 22:38:25 +0000

  libvirt (8.0.0-1ubuntu7.13) jammy; urgency=medium

  * d/p/u/lp-2117467-virdevmapper-device-name-for-targets.patch:
    virdevmapper: Always use device name for finding targets. This ensures
    that all the target devices of a multipath device are added to the
    namespace/cgroup of the guest domain.
    Closes LP: #2117467.

 -- Bhavin Gandhi <email address hidden> Tue, 22 Jul 2025 13:50:20 +0530

  libvirt (8.0.0-1ubuntu7.12) jammy; urgency=medium

  * d/p/u/lp2106812-cpu_map-Drop-mpx-from-x86-cpu-models.patch:
    Memory protection extensions (MPX) were introduced in Intel Skylake
    generation CPUs and provided hardware support for bound checking. This
    feature will not be supported in Intel CPUs beginning with the Ice Lake
    generation. Remove missing mpx feature so that libvirts detects correctly
    CPU models (Icelake, ..) instead of the old Blackwell (LP: #2106812)

 -- Hector Cao <email address hidden> Wed, 23 Apr 2025 03:41:12 +0200

  libvirt (8.0.0-1ubuntu7.11) jammy; urgency=medium

  * d/p/u/lp-2077336-drop-tpm-tis-arch-validation-*.patch: Drop tpm-tis
    validation and fix armv7l VM creation. (LP: #2077336)

 -- Sergio Durigan Junior <email address hidden> Wed, 04 Sep 2024 21:27:45 -0400