Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-63623 →

DEBIAN-CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-3+deb13u3"}]}]

Debian:14 libvirt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.6.0-1"}]}]

Références

advisory security-tracker.debian.org