CVE-2013-4419
EPSS 0.75%
描述
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
如何修補 CVE-2013-4419
要修補 CVE-2013-4419,請將受影響套件升級到下列已修補版本。
- Debian/libguestfs—升級至 1:1.22.7-1 或更新版本
CVE-2013-4419 正在被利用嗎?
低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1:1.22.7-1