https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:45:27 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-63622 <p><strong>Affected:</strong> Alpaquita:23: libvirt, Alpaquita:25: libvirt, Alpaquita:stream: libvirt</p> <p><strong>Affected:</strong> Alpaquita:23: libvirt, Alpaquita:25: libvirt, Alpaquita:stream: libvirt</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-63622 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63622 <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63622 https://vulnerability.circl.lu/vuln/ghsa-r329-fjhj-3cw3 <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> https://vulnerability.circl.lu/vuln/ghsa-r329-fjhj-3cw3 https://vulnerability.circl.lu/vuln/oesa-2026-3632 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libvirt</p> <p>Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es):</p> <p>A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon&amp;apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)</p> <p>An injection vulnerability was found in libvirt&amp;apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-l…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libvirt</p> <p>Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es):</p> <p>A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon&amp;apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)</p> <p>An injection vulnerability was found in libvirt&amp;apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-l…</p> https://vulnerability.circl.lu/vuln/oesa-2026-3632 https://vulnerability.circl.lu/vuln/opensuse-su-2026:21738-1 <p>Security update for libvirt</p> <p>Security update for libvirt</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:21738-1 https://vulnerability.circl.lu/vuln/rhsa-2026:64773 <p>libvirt: swtpm privilege escalation via symlink following</p> <p>libvirt: swtpm privilege escalation via symlink following</p> https://vulnerability.circl.lu/vuln/rhsa-2026:64773 https://vulnerability.circl.lu/vuln/suse-su-2026:23445-1 <p>Security update for libvirt</p> <p>Security update for libvirt</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23445-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-63622 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: libvirt, Ubuntu:22.04:LTS: libvirt, Ubuntu:24.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt-hwe</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: libvirt, Ubuntu:22.04:LTS: libvirt, Ubuntu:24.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt-hwe</p> <p>A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-63622