[SECURITY] Fedora 19 Update: libvirt-1.0.5.6-2.fc19

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-17618
2013-09-26 04:49:04
--------------------------------------------------------------------------------

Name        : libvirt
Product     : Fedora 19
Version     : 1.0.5.6
Release     : 2.fc19
URL         : http://libvirt.org/
Summary     : Library providing a simple virtualization API
Description :
Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). The main package includes
the libvirtd server exporting the virtualization support.

--------------------------------------------------------------------------------
Update Information:

* Fix snapshot restore when VM has disabled usb support (bz #1011520)
* Rebased to version 1.0.5.6
* Fix blockjobinfo python API (bz #999077)
* CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332)
* CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667)
* CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511)
* CVE-2013-5651: virBitmapParse out-of-bounds (bz #1006493)
* Fix virsh change-media with block disk type (bz #951192)
* Fix changing VNC listen address (bz #1006697)
--------------------------------------------------------------------------------
ChangeLog:

* Tue Sep 24 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.6-2
- Fix snapshot restore when VM has disabled usb support (bz #1011520)
* Fri Sep 20 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.6-1
- Rebased to version 1.0.5.6
- Fix blockjobinfo python API (bz #999077)
- CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332)
- CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667)
- CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511)
- CVE-2013-5651: virBitmapParse out-of-bounds (bz #1006493)
- Fix virsh change-media with block disk type (bz #951192)
- Fix changing VNC listen address (bz #1006697)
* Thu Aug  1 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.5-1
- Rebased to version 1.0.5.5
- Really fix /dev/tty inside a container (bz #982317)
- Fix possible deadlock from getpwuid_r (bz #964358)
* Fri Jul 12 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.4-1
- Rebased to version 1.0.5.4
- Fix crash on migration
* Thu Jul 11 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.3-1
- Rebased to version 1.0.5.3
- Allow /dev/tty in LXC container (bz #982317)
- Fix cpu hot-add with latest qemu (bz #979260)
- Fix crash in udev logging (bz #969152)
* Wed Jun 12 2013 Cole Robinson <crobinso at redhat.com> - 1.0.5.2-1
- Rebased to version 1.0.5.2
- Don't error if disk resize isn't multiple of 512 (bz #951495)
- Fix racey cgroup error at VM startup (bz #965169)
- Fix crash in nwfilter at daemon shutdown (bz #967740)
- Fix 'tray is locked' error on media eject (bz #967914)
- Error on invalid combo of --tunnelled and --copy-storage (bz #968043)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1005332 - CVE-2013-4311 libvirt: insecure calling of polkit
        https://bugzilla.redhat.com/show_bug.cgi?id=1005332
  [ 2 ] Bug #1006173 - CVE-2013-4296 libvirt: invalid free in remoteDispatchDomainMemoryStats
        https://bugzilla.redhat.com/show_bug.cgi?id=1006173
  [ 3 ] Bug #1006509 - CVE-2013-4291 libvirt: supplementary groups not adjusted correctly when parsing label
        https://bugzilla.redhat.com/show_bug.cgi?id=1006509
  [ 4 ] Bug #1006493 - CVE-2013-5651 libvirt: virBitmapParse out-of-bounds read access
        https://bugzilla.redhat.com/show_bug.cgi?id=1006493
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update libvirt' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------