[ubuntu/resolute-updates] libvirt-hwe 12.0.0-1ubuntu5.5 (Accepted)

[Ubuntu Archive Robot]

libvirt-hwe (12.0.0-1ubuntu5.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Privileged arbitrary command execution in network driver.
    - debian/patches/CVE-2026-61477-1.patch: Reject line breaks in DNS TXT
      record values in src/conf/network_conf.c
    - debian/patches/CVE-2026-61477-2.patch: Reject line breaks in DNS SRV
      domain and target in src/conf/network_conf.c
    - debian/patches/CVE-2026-61477-3.patch: Reject line breaks before
      writing dnsmasq DNS config in src/network/bridge_driver.c
    - debian/patches/CVE-2026-61477-4.patch: Add negative tests that feed
      XML numeric character references into the DNS TXT value and SRV
      domain/target attributes.
    - CVE-2026-61477
  * SECURITY UPDATE: Denial of service in XML parsing
    - debian/patches/CVE-2026-61478.patch: Fix crash searching for XML context
      string on errors in src/util/virxml.c
    - CVE-2026-61478
  * SECURITY UPDATE: Privilege escalation in Virtual TPM
    - debian/patches/CVE-2026-63622.patch: Do not follow symlinks in
      src/util/virfile.c
    - CVE-2026-63622
  * SECURITY UPDATE: Information disclosure in image cloning/conversion
    - debian/patches/CVE-2026-63623.patch: Create images with a private umask
      during qemu-img create/convert in src/storage/storage_util.c
    - CVE-2026-63623
  * SECURITY UPDATE: integer overflow in NodeGetFreePages RPC handler
    - debian/patches/CVE-2026-18917.patch: remote: Fix integer overflow in RPC
      handler for virNodeGetFreePages in src/remote/remote_daemon_dispatch.c.
    - CVE-2026-18917
  * SECURITY UPDATE: symlink-following flaw
    - debian/patches/CVE-2026-77159.patch: qemu: tpm: Avoid following symlinks
      when chown'ing log file in src/qemu/qemu_tpm.c.
    - CVE-2026-77159

Date: 2026-09-24 13:58:12.253469+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/libvirt-hwe/12.0.0-1ubuntu5.5
-------------- next part --------------
Sorry, changesfile not available.