CVE-2013-4419 Details
Description
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html | CVE | Mailing ListThird Party Advisory |
| http://rhn.redhat.com/errata/RHSA-2013-1536.html | CVE | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1016960 | CVE | PatchThird Party Advisory |
| http://secunia.com/advisories/55813 | CVE | Third Party Advisory |
| https://www.redhat.com/archives/libguestfs/2013-October/msg00031.html | CVE | Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html | [email protected] | Mailing ListThird Party Advisory |
| http://rhn.redhat.com/errata/RHSA-2013-1536.html | [email protected] | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1016960 | [email protected] | PatchThird Party Advisory |
| http://secunia.com/advisories/55813 | [email protected] | Third Party Advisory |
| https://www.redhat.com/archives/libguestfs/2013-October/msg00031.html | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-264 | Permissions, Privileges, and Access Controls | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libguestfs libguestfs | >= 1.20.0, <= 1.20.12 >= 1.22.0, <= 1.22.7 |
CPE
Remediation
| |
| suse suse linux enterprise software development kit | 11.0 sp3 |
CPE
Remediation
| |
| novell suse linux enterprise server | 11.0 sp3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | [email protected] |
| Apr 29, 2026 | Status Change | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Dec 13, 2018 | Reanalysis | [email protected] |
| Jan 14, 2015 | Modified Analysis | [email protected] |
| Nov 6, 2013 | Initial Analysis | [email protected] |