There are new 4 CVE CVE-2018-12130 CVE-2018-12126 CVE-2018-12127 CVE-2019-11091

Debian stretch kernel is vulnerable https://security-tracker.debian.org/tracker/CVE-2018-12130

Even if you get a newer kernel from Kernel.org in notes types that libvirt is vulnerable. It say: https://libvirt.org/git/?p=libvirt.git;a=commit;h=538d873571d7a682852dc1d70e5f4478f4d64e85 qemu and libvirt need updates to passthrough md-clear, see #929067 for qemu and #929154 for libvirt

But when I try apt update && apt upgrade I don't see qemu and libvirt to update. When I use links from notes to go and see what's going on there - there a just bugreports and code commits, but no link to upgrade qemu and libvirt How to upgrade qemu and libvirt ?

  • 1
    Regarding the kernel, a fixed kernel was released several days ago in stretch-security, you don’t need to use a kernel.org kernel. – Stephen Kitt May 25 '19 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.