6.8
CVE-2013-4419
- EPSS 0.08%
- Published 05.11.2013 20:55:29
- Last modified 11.04.2025 00:51:21
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Data is provided by the National Vulnerability Database (NVD)
Libguestfs ≫ Libguestfs Version >= 1.20.0 <= 1.20.12
Libguestfs ≫ Libguestfs Version >= 1.22.0 <= 1.22.7
Suse ≫ Suse Linux Enterprise Software Development Kit Version11.0 Updatesp3
Novell ≫ Suse Linux Enterprise Server Version11.0 Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.249 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 3.2 | 10 |
AV:A/AC:H/Au:N/C:C/I:C/A:C
|