CVE-2013-4419

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Metrics

CVSS 2.0 6.8/10AV:A/AC:H/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1536.htmlThird Party Advisory
http://secunia.com/advisories/55813Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1016960Patch, Third Party Advisory
https://www.redhat.com/archives/libguestfs/2013-October/msg00031.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1536.htmlThird Party Advisory
http://secunia.com/advisories/55813Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1016960Patch, Third Party Advisory
https://www.redhat.com/archives/libguestfs/2013-October/msg00031.htmlThird Party Advisory

Timeline

Published: Nov 5, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44205.8Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allo CVE-2013-44215.0The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory c CVE-2013-44226.8SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attacker CVE-2013-44235.5CloudForms stores user passwords in recoverable format CVE-2013-44244.3Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to i CVE-2013-44251.9The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" a CVE-2013-44263.6pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple fai CVE-2013-44272.1pyxtrlock before 0.2 does not properly check the return values of the (1) xcb_grab_pointer and (2) xcb_grab_keyboard XCB library functions, CVE-2013-44283.5OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image po CVE-2013-44294.0Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authent CVE-2013-44304.3Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inje CVE-2013-44315.5Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticat