Every CVE Search/ Get API key

CVE-2013-4419

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or -...

6.8 MediumFix available

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Exploit likelihood

0.75%Down 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
CVE-2013-4419
CVSS 2.0
6.8 MediumAV:A/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
CVE-2013-4419
Updated
2026-11-02
EUVDEUVD-2013-4296 No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
EUVD-2013-4296
Updated
2026-11-03
GitHub AdvisoriesGHSA-3vxx-8f6w-cpxp No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or -...

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
GHSA-3vxx-8f6w-cpxp
Updated
2026-11-02
OSV No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
CVE-2013-4419
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4419 No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
DEBIAN-CVE-2013-4419
Updated
2026-11-02
OSVopenSUSE-SU-2024:10032-1 No score

guestfs-data-1.32.4-11.1 on GA media

These are all security issues fixed in the guestfs-data-1.32.4-11.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10032-1
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4419 No score

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Record
UBUNTU-CVE-2013-4419
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libguestfs
Debian:12
 before 1:1.22.7-1
1:1.22.7-1
libguestfs
Debian:13
 before 1:1.22.7-1
1:1.22.7-1
libguestfs
Debian:14
 before 1:1.22.7-1
1:1.22.7-1
libguestfs
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-debuginfo
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-devel
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java-devel
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-javadoc
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs-devel
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
Show 54 moreShow less
Affected packages
PackageAffectedFixed
ruby-libguestfs
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools-c
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
perl-Sys-Guestfs
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
python-libguestfs
Red Hat:enterprise_linux:6::client
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-javadoc
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ruby-libguestfs
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools-c
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
perl-Sys-Guestfs
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
python-libguestfs
Red Hat:enterprise_linux:6::computenode
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-devel
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java-devel
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-javadoc
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs-devel
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ruby-libguestfs
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools-c
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
perl-Sys-Guestfs
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
python-libguestfs
Red Hat:enterprise_linux:6::server
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-javadoc
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ocaml-libguestfs-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
ruby-libguestfs
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-java
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs-tools-c
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
perl-Sys-Guestfs
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
python-libguestfs
Red Hat:enterprise_linux:6::workstation
 before 1:1.20.11-2.el6
1:1.20.11-2.el6
libguestfs
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:1.28.12-1ubuntu21:1.28.12-1ubuntu31:1.30.6-1ubuntu11:1.30.6-1ubuntu21:1.32.2-3ubuntu11:1.32.2-4ubuntu11:1.32.2-4ubuntu21:1.32.2-4ubuntu2.2
 None known
libguestfs
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:1.34.6-7ubuntu11:1.36.10-1ubuntu21:1.36.10-1ubuntu31:1.36.11-1ubuntu11:1.36.13-1ubuntu2
Show 4 moreShow less
1:1.36.13-1ubuntu31:1.36.13-1ubuntu3.11:1.36.13-1ubuntu3.21:1.36.13-1ubuntu3.3
 None known
libguestfs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.40.2-2ubuntu61:1.40.2-2ubuntu81:1.40.2-7ubuntu31:1.40.2-7ubuntu41:1.40.2-7ubuntu5
 None known
libguestfs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.44.1-1ubuntu61:1.44.1-1ubuntu91:1.44.1-1ubuntu101:1.44.1-1ubuntu111:1.46.2-10ubuntu21:1.46.2-10ubuntu3
 None known
libguestfs
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.50.1-4ubuntu11:1.50.1-4ubuntu21:1.52.0-2ubuntu11:1.52.0-2ubuntu21:1.52.0-5ubuntu11:1.52.0-5ubuntu21:1.52.0-5ubuntu3
 None known
libguestfs
Ubuntu:25.10
 All versions, plus listed versions
1:1.54.1-1ubuntu31:1.54.1-2ubuntu21:1.54.1-2ubuntu3
 None known
libguestfs
Ubuntu:26.10
 All versions, plus listed versions
1:1.58.1-3ubuntu31:1.58.1-5ubuntu21:1.58.1-7ubuntu2.21:1.58.1-7ubuntu41:1.60.1-2ubuntu1
 None known
libguestfs
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.54.1-2ubuntu31:1.54.1-2ubuntu41:1.54.1-2ubuntu51:1.54.1-2ubuntu61:1.54.1-2ubuntu7
Show 9 moreShow less
1:1.54.1-3ubuntu11:1.54.1-3.1ubuntu11:1.56.2-4ubuntu21:1.56.2-4ubuntu31:1.56.2-5ubuntu21:1.56.2-6ubuntu11:1.58.1-3ubuntu11:1.58.1-3ubuntu21:1.58.1-3ubuntu3
 None known
libguestfs
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.32.4-11.1
1.32.4-11.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4419 is a medium vulnerability (CVSS 6.8) in Libguestfs, published November 5, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in libguestfs 1:1.22.7-1.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open