{"id":"CVE-2020-15708","aliases":["EUVD-2020-7694","GHSA-6pr6-q53r-2q97","SUSE-SU-2020:2969-1","SUSE-SU-2020:2970-1","SUSE-SU-2020:3037-1","SUSE-SU-2020:3038-1","SUSE-SU-2020:3039-1","SUSE-SU-2020:3095-1","SUSE-SU-2020:3143-1","UBUNTU-CVE-2020-15708","USN-4452-1","openSUSE-SU-2020:1777-1","openSUSE-SU-2020:1778-1","openSUSE-SU-2024:11008-1"],"status":"published","title":"Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.004,"percentile":0.34594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2020-08-04T17:00:00Z","modified":"2026-06-17T02:57:05Z","fixes":[{"ecosystem":"Ubuntu:20.04:LTS","package":"libvirt","fixed_in":["6.0.0-0ubuntu8.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-9.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-8.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-8.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-8.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-8.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-8.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-8.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-27.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-27.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-27.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-27.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.3"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.3"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-lp152.9.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-lp151.7.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-2.1"}]}],"bundled":21}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"ubuntu","product":"libvirt"}],"references":[{"url":"https://usn.ubuntu.com/usn/usn-4452-1","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15708"},{"url":"https://github.com/advisories/GHSA-6pr6-q53r-2q97"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202969-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171701","tags":["report"]},{"url":"https://bugzilla.suse.com/1174955","tags":["report"]},{"url":"https://bugzilla.suse.com/1177155","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25637","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202970-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173157","tags":["report"]},{"url":"https://bugzilla.suse.com/1174139","tags":["report"]},{"url":"https://bugzilla.suse.com/1175465","tags":["report"]},{"url":"https://bugzilla.suse.com/1176430","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175574","tags":["report"]},{"url":"https://bugzilla.suse.com/1177480","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203038-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203039-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203095-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203143-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15708","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4452-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15708","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3OCPTCY4NDHTGHFZWIAO6KHGTLUQSXQ5/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJK5HZ5F2H34L3UWADRCLKFCCF5KDLVY/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3667","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15708","title":"Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","status":"published","published":"2020-11-06T01:40:13.864Z","modified":"2024-09-16T17:37:51.206Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7694","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","status":"published","published":"2020-11-06T01:40:13Z","modified":"2024-09-16T17:37:51Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:40.580982Z"}],"ghsa":[{"id":"GHSA-6pr6-q53r-2q97","title":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write...","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","status":"published","published":"2022-05-24T17:33:17Z","modified":"2024-02-08T18:30:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:55:34.624515Z"}],"nvd":[{"id":"CVE-2020-15708","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","status":"published","published":"2020-11-06T02:15:12.05Z","modified":"2026-06-17T02:57:05.913Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"UBUNTU-CVE-2020-15708","description":"Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.","status":"published","published":"2020-08-04T17:00:00Z","modified":"2026-04-22T12:30:50.354511Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"openSUSE-SU-2020:1777-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- qemu: Avoid stale capabilities cache host CPU or kernel command line changes (bsc#1173157).\n- virdevmapper: Handle kernel without device-mapper support (bsc#1175465).\n- Xen: Added support for passing arbitrary commands to the qemu device model, similar to the xl.cfg(5) device_model_args setting (bsc#1174139).\n- Xen: Don't add dom0 twice on driver reload (bsc#1176430).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-30T17:23:30Z","modified":"2026-02-04T02:42:29.509447Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1778-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\t  \n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- qemu: Adjust max memlock on mdev hotplug (bsc#1177480).\n- Xen: Don't add dom0 twice on driver reload (bsc#1176430).\n- virdevmapper: Handle kernel without device-mapper support (bsc#1175465).\n- Fixed an issue where building was failing (bsc#1175574).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-10-30T17:23:42Z","modified":"2026-02-04T02:59:26.417237Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11008-1","title":"libvirt-7.7.0-2.1 on GA media","description":"These are all security issues fixed in the libvirt-7.7.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:01:04.623891Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:2969-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- libxl: Fixed lock manager lock ordering (bsc#1171701).\n","status":"published","published":"2020-10-20T14:05:57Z","modified":"2026-02-04T02:39:29.187482Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2970-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- qemu: Avoid stale capabilities cache host CPU or kernel command line changes (bsc#1173157).\n- virdevmapper: Handle kernel without device-mapper support (bsc#1175465).\n- Xen: Added support for passing arbitrary commands to the qemu device model, similar to the xl.cfg(5) device_model_args setting (bsc#1174139).\n- Xen: Don't add dom0 twice on driver reload (bsc#1176430).\n","status":"published","published":"2020-10-20T14:06:17Z","modified":"2026-02-04T03:19:45.776138Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3037-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\t  \n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- qemu: Adjust max memlock on mdev hotplug (bsc#1177480).\n- Xen: Don't add dom0 twice on driver reload (bsc#1176430).\n- virdevmapper: Handle kernel without device-mapper support (bsc#1175465).\n- Fixed an issue where building was failing (bsc#1175574).\n","status":"published","published":"2020-10-26T15:20:48Z","modified":"2026-02-04T04:07:36.811531Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3038-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- libxl: Fixed lock manager lock ordering (bsc#1171701).\n","status":"published","published":"2020-10-27T08:08:14Z","modified":"2026-02-04T03:15:35.66053Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3039-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n- qemu: Adjust max memlock on mdev hotplug (bsc#1177480).\n- Xen: Don't add dom0 twice on driver reload (bsc#1176430).\t  \n- Fixed an issue where building was failing (bsc#1175574).\n","status":"published","published":"2020-10-27T08:08:29Z","modified":"2026-02-04T02:42:28.505523Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3095-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\nCVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\nCVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n","status":"published","published":"2020-10-29T17:05:11Z","modified":"2026-02-04T02:16:58.59395Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3143-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2020-15708: Added a  note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).\n- CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).\n","status":"published","published":"2020-11-03T15:15:10Z","modified":"2026-02-04T04:03:39.177144Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4452-1","title":"libvirt vulnerability","description":"Trent Shea working with Trend Micro´s Zero Day Initiative, discovered that\nthe libvirt package set incorrect permissions on the UNIX domain socket. A\nlocal attacker could use this issue to access libvirt and escalate\nprivileges.\n","status":"published","published":"2020-08-04T17:31:40Z","modified":"2026-04-22T10:06:47.390799Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}