Libguestfs
Approved changes feed: RSS · Atom
cpe:2.3:a:libguestfs:libguestfs:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Libguestfs (57df46a9-36fe-575a-9613-b025144d605a) |
|---|---|
| Product | Libguestfs (5885e903-90a9-5ddc-992c-9a7baac7c7bf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/libguestfs |
purl2cpe | 2026-06-01 10:18:02.214062 |
pkg:deb/ubuntu/libguestfs |
purl2cpe | 2026-06-01 10:18:02.214065 |
pkg:github/libguestfs/libguestfs |
purl2cpe | 2026-06-01 10:18:02.214068 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2013-4419 |
vulnerable | 2026-06-08 05:04:36.078092 |
Details available
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Published: 2013-11-05T20:00:00.000Z
Updated: 2024-08-06T16:45:14.194Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2690 |
vulnerable | 2026-06-08 05:02:05.483745 |
Details available
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.
Published: 2012-06-29T19:00:00.000Z
Updated: 2024-08-06T19:42:32.302Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-3851 |
vulnerable | 2026-06-08 04:55:17.568279 |
Details available
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
Published: 2010-11-04T17:00:00.000Z
Updated: 2024-08-07T03:26:11.393Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.