From fdb6a5d79eb35a814d72c002ff451aa788b03851 Mon Sep 17 00:00:00 2001 From: Mauro Matteo Cascella Date: Fri, 2 Oct 2020 13:09:35 +0200 Subject: [PATCH] NEWS: mention CVE-2020-25637 in v6.8.0 release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Mauro Matteo Cascella Reviewed-by: Ján Tomko --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index de46cac8c5..f6074d9fe8 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -27,6 +27,14 @@ v6.9.0 (unreleased) v6.8.0 (2020-10-01) =================== +* **Security** + + * qemu: double free in qemuAgentGetInterfaces() in qemu_agent.c + + Clients connecting to the read-write socket with limited ACL permissions + may be able to crash the libvirt daemon, resulting in a denial of service, + or potentially escalate their privileges on the system. CVE-2020-25637. + * **New features** * xen: Add ``writeFiltering`` attribute for PCI devices