CVE-2013-4401
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the...
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
Exploit likelihood
What each source reports
NVD Score used
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
CVE-2013-4401- CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
CVE-2013-4401- Updated
- 2026-11-02
EUVDEUVD-2013-4280 No score
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2013-4280- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6vr-89w4-8gh3 No score
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the...
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
GHSA-p6vr-89w4-8gh3- Updated
- 2026-11-02
OSVBELL-CVE-2013-4401
CVE-2013-4401 does not affect BellSoft software
- Record
BELL-CVE-2013-4401- CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
OSV No score
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
CVE-2013-4401- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4401 No score
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
- Record
DEBIAN-CVE-2013-4401- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10209-1 No score
libvirt-2.5.0-1.1 on GA media
These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10209-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4401 is a high vulnerability (CVSS 8.5) in Redhat Libvirt, published November 2, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in libvirt 1.1.4-1.
References
secunia.com/advisories/60895
security.gentoo.org/glsa/glsa-201412-04.xml
bugzilla.redhat.com/show_bug.cgi?id=1015259
wiki.libvirt.org/page/Maintenance_Releases
libvirt.org/git?p=libvirt.git%3Ba=commit%3Bh=57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c
ubuntu.com/usn/USN-2026-1
Show 39 moreShow less
securitytracker.com/id/1029241
nvd.nist.gov/vuln/detail/CVE-2013-4401
github.com/advisories/GHSA-p6vr-89w4-8gh3
docs.bell-sw.com/security/cves/CVE-2013-4401
security-tracker.debian.org/tracker/CVE-2013-4401
suse.com/security/cve/CVE-2010-2242