CVE-2019-10161
Publication date 20 June 2019
Last updated 25 August 2025
Ubuntu priority
Description
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libvirt | ||
| 20.04 LTS focal |
Fixed in 5.4.0-0ubuntu3
|
|
| 18.04 LTS bionic |
Fixed in 4.0.0-1ubuntu8.12
|
|
| 16.04 LTS xenial |
Fixed in 1.3.1-1ubuntu10.27
|
|
| 14.04 LTS trusty |
Fixed in 1.2.2-0ubuntu13.1.28+esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialPatch details
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.8 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4047-1
- libvirt vulnerabilities
- 8 July 2019
- USN-4047-2
- libvirt update vulnerability
- 13 January 2020