A buffer overflow flaw was found in libvirtproxy. libvirtproxy is set to run as a setuid root by default, so in theory this could allow for a local user to become root.

Normally the stack protector would prevent this from being an issue, but it seems that with gcc optimizations, the function in question is being inlined into main(), preventing the stack protector from catching this.

The original report can be found here: https://www.redhat.com/archives/libvir-list/2009-January/msg00699.html

The patch is here: http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=2bb0657e28