CVE-2013-4419
Fixed in a distro release EPSS <1%
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Products: libguestfs, suse_linux_enterprise_software_development_kit, novell suse_linux_enterprise_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libguestfs | 1:1.22.7-1 |
| Debian 13 | libguestfs | 1:1.22.7-1 |
| Debian 14 | libguestfs | 1:1.22.7-1 |
| Red Hat Enterprise Linux 6 | libguestfs | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-debuginfo | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-devel | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-java | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-java-devel | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-javadoc | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-tools | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | libguestfs-tools-c | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | ocaml-libguestfs | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | ocaml-libguestfs-devel | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | perl-Sys-Guestfs | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | python-libguestfs | 1:1.20.11-2.el6 |
| Red Hat Enterprise Linux 6 | ruby-libguestfs | 1:1.20.11-2.el6 |
| Ubuntu 16.04 LTS | libguestfs | no fix |
| Ubuntu 18.04 LTS | libguestfs | no fix |
| Ubuntu 20.04 LTS | libguestfs | no fix |
| Ubuntu 22.04 LTS | libguestfs | no fix |
| Ubuntu 24.04 LTS | libguestfs | no fix |
| Ubuntu 25.10 | libguestfs | no fix |
| Ubuntu 26.04 LTS | libguestfs | no fix |
| Ubuntu 26.10 | libguestfs | no fix |
| openSUSE Tumbleweed | libguestfs | 1.32.4-11.1 |