gpp_maybe Security update for libvirt
SUSE-SL-Micro-6.2-1586


This update for libvirt fixes the following issues: - CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863). - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576). - CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt` daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264). - CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265). - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).


cloud_download Downloads

SUSE Linux Micro 6.2 ppc64le
SUSE Linux Micro 6.2 s390x
SUSE Linux Micro 6.2 aarch64
SUSE Linux Micro 6.2 x86_64