From ce562cb8e63c1bec7f08092cacced48cd70b6652 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Sat, 8 Aug 2020 17:19:52 +0200 Subject: Update status for CVE-2020-15708/libvirt --- data/CVE/list | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/data/CVE/list b/data/CVE/list index 6ecc2a3d00..e9b889fc7f 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -3636,9 +3636,14 @@ CVE-2020-15709 NOTE: https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1890286 CVE-2020-15708 [incorrect permissions on the UNIX domain socket allows local attacker to escalate privileges] RESERVED - - libvirt + - libvirt (Ubuntu specific issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1866270#c2 - TODO: check if affects Debian packaging when using libvirtd.socket, similarly as the Ubuntu one + NOTE: Debian used to use polkit in 1.2.9-rc1-1 and only later on + NOTE: enabled as well libvirtd socket activation. Ubuntu OTOH continued + NOTE: to ship the Allow-libvirt-group-to-access-the-socket.patch patch + NOTE: which caused the CVE-2020-15708 issue. + NOTE: Upstream improved documentation in with: + NOTE: https://www.redhat.com/archives/libvir-list/2020-August/msg00360.html CVE-2020-15707 (Integer overflows were discovered in the functions grub_cmd_initrd and ...) {DSA-4735-1} - grub2 2.04-9 -- cgit v1.2.3