Unscored severity · published Mar 20, 2013
CVE-2013-1766
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors
–
CVSS
0.4%
EPSS
No
On KEV
Description
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libvirt · Redhat
through 1.0.2; 0.0.1; 0.0.2; 0.0.3; 0.0.4; 0.0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1766
Vendor Advisory
http://secunia.com/advisories/52628
www.debian.org
http://www.debian.org/security/2013/dsa-2650
www.securityfocus.com
http://www.securityfocus.com/bid/58178
More from Libvirt
9.8
CVE-2016-5008
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and…
8.8
CVE-2020-14339
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process
8.8
CVE-2019-10132
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units
8.1
CVE-2017-1000256
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates…
7.8
CVE-2019-10168
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the…