SB2019042907 - OpenSUSE Linux update for libvirt

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2019-3840)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in libvirt in the way it processes interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service (DoS).

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-3886)

The vulnerability allows a remote attacker to gain access to sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to the application allows readonly permissions to invoke the APIs depending on the guest agent. A remote non-authenticated attacker can gain access to sensitive information or perform denial of service attack.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.html