{"schema_version":"1.7.2","id":"OESA-2026-3834","modified":"2026-09-14T16:34:50Z","published":"2026-09-14T16:34:50Z","upstream":["CVE-2026-63623"],"summary":"libvirt security update","details":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"libvirt","purl":"pkg:rpm/openEuler/libvirt&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-73.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["libvirt-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-admin-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-bash-completion-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-client-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-config-network-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-config-nwfilter-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-interface-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-network-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-nodedev-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-nwfilter-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-qemu-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-secret-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-core-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-disk-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-gluster-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-iscsi-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-iscsi-direct-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-logical-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-mpath-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-rbd-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-driver-storage-scsi-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-kvm-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-daemon-qemu-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-debuginfo-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-debugsource-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-devel-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-docs-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-libs-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-lock-sanlock-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-nss-6.2.0-73.oe2203sp4.aarch64.rpm","libvirt-wireshark-6.2.0-73.oe2203sp4.aarch64.rpm"],"src":["libvirt-6.2.0-73.oe2203sp4.src.rpm"],"x86_64":["libvirt-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-admin-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-bash-completion-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-client-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-config-network-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-config-nwfilter-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-interface-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-network-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-nodedev-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-nwfilter-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-qemu-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-secret-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-core-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-disk-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-gluster-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-iscsi-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-iscsi-direct-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-logical-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-mpath-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-rbd-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-driver-storage-scsi-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-kvm-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-daemon-qemu-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-debuginfo-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-debugsource-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-devel-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-docs-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-libs-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-lock-sanlock-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-nss-6.2.0-73.oe2203sp4.x86_64.rpm","libvirt-wireshark-6.2.0-73.oe2203sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3834"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63623"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"database_specific":{"severity":"Medium"}}