{"id":"UBUNTU-CVE-2013-4419","details":"The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.","modified":"2026-05-20T16:03:06.228848741Z","published":"2013-11-05T20:55:00Z","upstream":["CVE-2013-4419"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2013-4419"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1016960"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2013-4419"}],"affected":[{"package":{"name":"libguestfs","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.28.12-1ubuntu2","1:1.28.12-1ubuntu3","1:1.30.6-1ubuntu1","1:1.30.6-1ubuntu2","1:1.32.2-3ubuntu1","1:1.32.2-4ubuntu1","1:1.32.2-4ubuntu2","1:1.32.2-4ubuntu2.2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"erlang-guestfs"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"gir1.2-guestfs-1.0"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"guestfsd","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"libguestfs-gobject-1.0-0"},{"binary_name":"libguestfs-hfsplus","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-java","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"libguestfs-jfs"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-ocaml","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"libguestfs-perl"},{"binary_name":"libguestfs-reiserfs","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"libguestfs-rescue"},{"binary_name":"libguestfs-rsync","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-tools","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-xfs","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_name":"libguestfs-zfs","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"libguestfs0"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"lua-guestfs"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"python-guestfs"},{"binary_name":"python3-guestfs","binary_version":"1:1.32.2-4ubuntu2.2"},{"binary_version":"1:1.32.2-4ubuntu2.2","binary_name":"ruby-guestfs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.34.6-7ubuntu1","1:1.36.10-1ubuntu2","1:1.36.10-1ubuntu3","1:1.36.11-1ubuntu1","1:1.36.13-1ubuntu2","1:1.36.13-1ubuntu3","1:1.36.13-1ubuntu3.1","1:1.36.13-1ubuntu3.2","1:1.36.13-1ubuntu3.3"],"ecosystem_specific":{"binaries":[{"binary_version":"1:1.36.13-1ubuntu3.3","binary_name":"erlang-guestfs"},{"binary_name":"gir1.2-guestfs-1.0","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"guestfsd","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-gobject-1.0-0","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-hfsplus","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-java","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-jfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_version":"1:1.36.13-1ubuntu3.3","binary_name":"libguestfs-ocaml"},{"binary_name":"libguestfs-perl","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-reiserfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-rescue","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_version":"1:1.36.13-1ubuntu3.3","binary_name":"libguestfs-rsync"},{"binary_name":"libguestfs-tools","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-xfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs-zfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"libguestfs0","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"lua-guestfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"php-guestfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"python-guestfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_name":"python3-guestfs","binary_version":"1:1.36.13-1ubuntu3.3"},{"binary_version":"1:1.36.13-1ubuntu3.3","binary_name":"ruby-guestfs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.40.2-2ubuntu6","1:1.40.2-2ubuntu8","1:1.40.2-7ubuntu3","1:1.40.2-7ubuntu4","1:1.40.2-7ubuntu5"],"ecosystem_specific":{"binaries":[{"binary_name":"erlang-guestfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"gir1.2-guestfs-1.0","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.40.2-7ubuntu5"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"guestfsd"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-gobject-1.0-0","binary_version":"1:1.40.2-7ubuntu5"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"libguestfs-hfsplus"},{"binary_name":"libguestfs-java","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-jfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-ocaml","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-perl","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-reiserfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"libguestfs-rescue"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"libguestfs-rsync"},{"binary_name":"libguestfs-tools","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-xfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs-zfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_name":"libguestfs0","binary_version":"1:1.40.2-7ubuntu5"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"lua-guestfs"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"php-guestfs"},{"binary_name":"python3-guestfs","binary_version":"1:1.40.2-7ubuntu5"},{"binary_version":"1:1.40.2-7ubuntu5","binary_name":"ruby-guestfs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.44.1-1ubuntu6","1:1.44.1-1ubuntu9","1:1.44.1-1ubuntu10","1:1.44.1-1ubuntu11","1:1.46.2-10ubuntu2","1:1.46.2-10ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"gir1.2-guestfs-1.0"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"guestfish","binary_version":"1:1.46.2-10ubuntu3"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"guestfsd"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"guestmount"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"libguestfs-gobject-1.0-0","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"libguestfs-hfsplus","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"libguestfs-java","binary_version":"1:1.46.2-10ubuntu3"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-jfs"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-nilfs"},{"binary_name":"libguestfs-ocaml","binary_version":"1:1.46.2-10ubuntu3"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-perl"},{"binary_name":"libguestfs-reiserfs","binary_version":"1:1.46.2-10ubuntu3"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-rescue"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-rsync"},{"binary_name":"libguestfs-tools","binary_version":"1:1.46.2-10ubuntu3"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-xfs"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs-zfs"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"libguestfs0"},{"binary_version":"1:1.46.2-10ubuntu3","binary_name":"lua-guestfs"},{"binary_name":"php-guestfs","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"python3-guestfs","binary_version":"1:1.46.2-10ubuntu3"},{"binary_name":"ruby-guestfs","binary_version":"1:1.46.2-10ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.50.1-4ubuntu1","1:1.50.1-4ubuntu2","1:1.52.0-2ubuntu1","1:1.52.0-2ubuntu2","1:1.52.0-5ubuntu1","1:1.52.0-5ubuntu2","1:1.52.0-5ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-guestfs-1.0","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"guestfish","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"guestfsd","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"guestmount"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"libguestfs-gobject-1.0-0t64","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"libguestfs-hfsplus"},{"binary_name":"libguestfs-java","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"libguestfs-jfs","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"libguestfs-ocaml","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"libguestfs-perl","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"libguestfs-reiserfs"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"libguestfs-rescue"},{"binary_name":"libguestfs-rsync","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"libguestfs-tools"},{"binary_name":"libguestfs-xfs","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"libguestfs-zfs"},{"binary_name":"libguestfs0t64","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"lua-guestfs","binary_version":"1:1.52.0-5ubuntu3"},{"binary_version":"1:1.52.0-5ubuntu3","binary_name":"php-guestfs"},{"binary_name":"python3-guestfs","binary_version":"1:1.52.0-5ubuntu3"},{"binary_name":"ruby-guestfs","binary_version":"1:1.52.0-5ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.54.1-1ubuntu3","1:1.54.1-2ubuntu2","1:1.54.1-2ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-guestfs-1.0","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"guestfish"},{"binary_name":"guestfsd","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"guestmount"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs-gfs2"},{"binary_name":"libguestfs-gobject-1.0-0t64","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs-hfsplus"},{"binary_name":"libguestfs-java","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"libguestfs-jfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs-ocaml"},{"binary_name":"libguestfs-perl","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"libguestfs-reiserfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"libguestfs-rescue","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs-rsync"},{"binary_name":"libguestfs-tools","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs-xfs"},{"binary_name":"libguestfs-zfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"libguestfs0t64"},{"binary_name":"lua-guestfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_name":"php-guestfs","binary_version":"1:1.54.1-2ubuntu3"},{"binary_version":"1:1.54.1-2ubuntu3","binary_name":"python3-guestfs"},{"binary_name":"ruby-guestfs","binary_version":"1:1.54.1-2ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}},{"package":{"name":"libguestfs","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libguestfs?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.54.1-2ubuntu3","1:1.54.1-2ubuntu4","1:1.54.1-2ubuntu5","1:1.54.1-2ubuntu6","1:1.54.1-2ubuntu7","1:1.54.1-3ubuntu1","1:1.54.1-3.1ubuntu1","1:1.56.2-4ubuntu2","1:1.56.2-4ubuntu3","1:1.56.2-5ubuntu2","1:1.56.2-6ubuntu1","1:1.58.1-3ubuntu1","1:1.58.1-3ubuntu2","1:1.58.1-3ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-guestfs-1.0","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"golang-guestfs-dev","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"guestfish","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"guestfsd","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"guestmount","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-gfs2","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-gobject-1.0-0t64","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-hfsplus","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-java","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-jfs","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs-nilfs","binary_version":"1:1.58.1-3ubuntu3"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"libguestfs-ocaml"},{"binary_name":"libguestfs-perl","binary_version":"1:1.58.1-3ubuntu3"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"libguestfs-rescue"},{"binary_name":"libguestfs-rsync","binary_version":"1:1.58.1-3ubuntu3"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"libguestfs-tools"},{"binary_name":"libguestfs-xfs","binary_version":"1:1.58.1-3ubuntu3"},{"binary_name":"libguestfs0t64","binary_version":"1:1.58.1-3ubuntu3"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"lua-guestfs"},{"binary_name":"php-guestfs","binary_version":"1:1.58.1-3ubuntu3"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"python3-guestfs"},{"binary_version":"1:1.58.1-3ubuntu3","binary_name":"ruby-guestfs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-4419.json"}}],"schema_version":"1.7.5","severity":[{"type":"Ubuntu","score":"low"}]}