Vulnerability-Lookup

CVE-2013-4311 (GCVE-0-2013-4311)

Vulnerability from cvelistv5 – Published: 2013-10-03 21:00 – Updated: 2024-08-06 16:38

Summary

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

7 references

URL	Tags
http://www.ubuntu.com/usn/USN-1954-1	vendor-advisoryx_refsource_UBUNTU
http://wiki.libvirt.org/page/Maintenance_Releases	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2013/09/18/6	mailing-listx_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2013-1272.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2013-1460.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2013-1…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2013-1…	vendor-advisoryx_refsource_SUSE

Date Public

2013-09-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:38:01.910Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-1954-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1954-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
          },
          {
            "name": "[oss-security] 20130918 Re: Fwd: [vs-plain] polkit races",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
          },
          {
            "name": "RHSA-2013:1272",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
          },
          {
            "name": "RHSA-2013:1460",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
          },
          {
            "name": "openSUSE-SU-2013:1550",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2013:1549",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-09-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-10-24T09:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-1954-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1954-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
        },
        {
          "name": "[oss-security] 20130918 Re: Fwd: [vs-plain] polkit races",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
        },
        {
          "name": "RHSA-2013:1272",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
        },
        {
          "name": "RHSA-2013:1460",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
        },
        {
          "name": "openSUSE-SU-2013:1550",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2013:1549",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4311",
    "datePublished": "2013-10-03T21:00:00.000Z",
    "dateReserved": "2013-06-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T16:38:01.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2013-4311",
      "date": "2026-09-29",
      "epss": "0.00404",
      "percentile": "0.32129"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.9.12:*:*:*:*:*:*:*",
                  "matchCriteriaId": "78C18997-7086-4BB0-8490-EDB5394951F6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3C433B92-DE77-4B44-BE9D-98449FC7BF1B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "28132532-C0C7-4EAE-ADAE-3ADA58AE2EC0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3DA73633-136A-422F-AF77-2C29224C6981",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6310759E-ADFB-4DF4-8D10-4DDC42D29AE2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7E2B1536-6671-4508-BC7D-6F11408B3CF0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AA7D7BAB-A2EC-4DD9-A7B8-D5806CD5F306",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "94E85C10-0192-46B4-828D-52BAE6A6F69C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "52AF89AC-A906-479F-85AA-E9D47A83778F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "67B77F63-C9AC-42D4-B9E2-4BBE196AC254",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3256288E-5A49-4DCD-AE30-6B4E21AEF970",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "25E764AE-3B7C-4378-97C5-10E835511684",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F982F65C-CBF9-4EE6-8FD6-C965141E42C9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F4BF8152-79A4-48C6-88EB-9D3FA7466844",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
                  "matchCriteriaId": "7118F616-25CA-4E34-AA13-4D14BB62419F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
                  "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
        },
        {
          "lang": "es",
          "value": "libvirt 1.0.5.x anterior a la versi\u00f3n 1.0.5.6, 0.10.2.x anterior a 0.10.2.8, y 0.9.12.x anterior a la versi\u00f3n 0.9.12.2 permite a usuarios locales evadir restricciones de acceso intencionadas mediante el aprovechamiento de una condici\u00f3n de carrera PolkitUnixProcess PolkitSubject en pkcheck a trav\u00e9s de un (1) proceso setuid o (2) proceso pkexec, un problema relacionado con CVE-2013-4288."
        }
      ],
      "id": "CVE-2013-4311",
      "lastModified": "2024-11-21T01:55:19.797",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "LOCAL",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 4.6,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ]
      },
      "published": "2013-10-03T21:55:04.287",
      "references": [
        {
          "source": "secalert@redhat.com",
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Patch"
          ],
          "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1954-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1954-1"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-264"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.9.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78C18997-7086-4BB0-8490-EDB5394951F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3C433B92-DE77-4B44-BE9D-98449FC7BF1B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28132532-C0C7-4EAE-ADAE-3ADA58AE2EC0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3DA73633-136A-422F-AF77-2C29224C6981",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6310759E-ADFB-4DF4-8D10-4DDC42D29AE2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7E2B1536-6671-4508-BC7D-6F11408B3CF0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AA7D7BAB-A2EC-4DD9-A7B8-D5806CD5F306",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "94E85C10-0192-46B4-828D-52BAE6A6F69C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52AF89AC-A906-479F-85AA-E9D47A83778F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "67B77F63-C9AC-42D4-B9E2-4BBE196AC254",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3256288E-5A49-4DCD-AE30-6B4E21AEF970",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "25E764AE-3B7C-4378-97C5-10E835511684",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F982F65C-CBF9-4EE6-8FD6-C965141E42C9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4BF8152-79A4-48C6-88EB-9D3FA7466844",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
                    "matchCriteriaId": "7118F616-25CA-4E34-AA13-4D14BB62419F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
                    "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
          },
          {
            "lang": "es",
            "value": "libvirt 1.0.5.x anterior a la versi\u00f3n 1.0.5.6, 0.10.2.x anterior a 0.10.2.8, y 0.9.12.x anterior a la versi\u00f3n 0.9.12.2 permite a usuarios locales evadir restricciones de acceso intencionadas mediante el aprovechamiento de una condici\u00f3n de carrera PolkitUnixProcess PolkitSubject en pkcheck a trav\u00e9s de un (1) proceso setuid o (2) proceso pkexec, un problema relacionado con CVE-2013-4288."
          }
        ],
        "id": "CVE-2013-4311",
        "lastModified": "2026-04-29T01:13:23.040",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.6,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2013-10-03T21:55:04.287",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Patch"
            ],
            "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1954-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1954-1"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-264"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-27T11:59:41+00:00",
      "cve": "CVE-2013-4311",
      "id": "CVE-2013-4311",
      "initial_release_date": "2013-09-18T00:00:00+00:00",
      "product_status:fixed": "72",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "34",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libvirt: insecure calling of polkit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2013/cve-2013-4311.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-08T00:31:40Z",
      "cve": "CVE-2013-4311",
      "id": "CVE-2013-4311",
      "initial_release_date": "2023-02-15T05:36:20Z",
      "product_status:known_not_affected": "712",
      "product_status:recommended": "815",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2013-4311",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2013-4311.json",
      "version": "22"
    }
  }
}

BDU:2015-09744 (CVE-2013-4288)

Vulnerability from fstec – Published: 2015-04-28 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимости операционной системы Gentoo Linux, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Summary

Множественные уязвимости пакета hplip (до версии 3.14.1) операционной системы Gentoo Linux, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена локально

Severity

7.2 (High) CVSS 2.0


                      
                        AV:L/AC:L/Au:N/C:C/I:C/A:C

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-362 - Одновременное выполнение с использованием общего ресурса с неправильной синхронизацией («Ситуация гонки»)

Aliases

CVE-2013-4288, CVE-2013-4311, CVE-2013-4324, CVE-2013-4325, CVE-2013-4327, GLSA-201406-27

References

1 reference

URL
http://security.gentoo.org/glsa/glsa-201406-27.xml

Impacted products

1 product from 1 vendor

Vendors

Gentoo Foundation Inc.

Products

Gentoo Linux

Versions

до 20140826 (Gentoo Linux)

Product types

Operating system

Mitigations

Обновление пакета hplip до версии 3.14.1 или выше

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Gentoo Foundation Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 20140826 (Gentoo Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 hplip \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.14.1 \u0438\u043b\u0438 \u0432\u044b\u0448\u0435",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "26.06.2014",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-09744",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2013-4288, CVE-2013-4311, CVE-2013-4324, CVE-2013-4325, CVE-2013-4327, GLSA-201406-27",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Gentoo Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 (\u00ab\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0433\u043e\u043d\u043a\u0438\u00bb) (CWE-362)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 hplip (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.14.1) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://security.gentoo.org/glsa/glsa-201406-27.xml",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-362",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)"
}

FKIE_CVE-2013-4311

Vulnerability from fkie_nvd - Published: 2013-10-03 21:55 - Updated: 2026-06-16 23:57

Severity

Summary

References

URL	Tags
secalert@redhat.com	http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html
secalert@redhat.com	http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2013-1272.html	Vendor Advisory
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2013-1460.html
secalert@redhat.com	http://wiki.libvirt.org/page/Maintenance_Releases	Patch
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2013/09/18/6
secalert@redhat.com	http://www.ubuntu.com/usn/USN-1954-1	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2013-1272.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2013-1460.html
af854a3a-2127-422b-91ae-364da2661108	http://wiki.libvirt.org/page/Maintenance_Releases	Patch
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2013/09/18/6
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-1954-1	Vendor Advisory

Impacted products

Vendor	Product	Version
redhat	libvirt	0.9.12
redhat	libvirt	0.10.2
redhat	libvirt	0.10.2.1
redhat	libvirt	0.10.2.2
redhat	libvirt	0.10.2.3
redhat	libvirt	0.10.2.4
redhat	libvirt	0.10.2.5
redhat	libvirt	0.10.2.6
redhat	libvirt	0.10.2.7
redhat	libvirt	1.0.5
redhat	libvirt	1.0.5.1
redhat	libvirt	1.0.5.2
redhat	libvirt	1.0.5.3
redhat	libvirt	1.0.5.4
redhat	libvirt	1.0.5.5
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
canonical	ubuntu_linux	13.04
redhat	enterprise_linux	6.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.9.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "78C18997-7086-4BB0-8490-EDB5394951F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C433B92-DE77-4B44-BE9D-98449FC7BF1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "28132532-C0C7-4EAE-ADAE-3ADA58AE2EC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3DA73633-136A-422F-AF77-2C29224C6981",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6310759E-ADFB-4DF4-8D10-4DDC42D29AE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E2B1536-6671-4508-BC7D-6F11408B3CF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA7D7BAB-A2EC-4DD9-A7B8-D5806CD5F306",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "94E85C10-0192-46B4-828D-52BAE6A6F69C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:0.10.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "52AF89AC-A906-479F-85AA-E9D47A83778F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "67B77F63-C9AC-42D4-B9E2-4BBE196AC254",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3256288E-5A49-4DCD-AE30-6B4E21AEF970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "25E764AE-3B7C-4378-97C5-10E835511684",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "49FEFFA5-371E-4B1D-AAAE-C71AEB79A4AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F982F65C-CBF9-4EE6-8FD6-C965141E42C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4BF8152-79A4-48C6-88EB-9D3FA7466844",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "7118F616-25CA-4E34-AA13-4D14BB62419F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
    },
    {
      "lang": "es",
      "value": "libvirt 1.0.5.x anterior a la versi\u00f3n 1.0.5.6, 0.10.2.x anterior a 0.10.2.8, y 0.9.12.x anterior a la versi\u00f3n 0.9.12.2 permite a usuarios locales evadir restricciones de acceso intencionadas mediante el aprovechamiento de una condici\u00f3n de carrera PolkitUnixProcess PolkitSubject en pkcheck a trav\u00e9s de un (1) proceso setuid o (2) proceso pkexec, un problema relacionado con CVE-2013-4288."
    }
  ],
  "id": "CVE-2013-4311",
  "lastModified": "2026-06-16T23:57:00.293",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-10-03T21:55:04.287",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.ubuntu.com/usn/USN-1954-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.ubuntu.com/usn/USN-1954-1"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-PR6P-RW96-X62R

Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2022-05-14 01:08

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-4311"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-10-03T21:55:00Z",
    "severity": "MODERATE"
  },
  "details": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.",
  "id": "GHSA-pr6p-rw96-x62r",
  "modified": "2022-05-14T01:08:27Z",
  "published": "2022-05-14T01:08:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4311"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
    },
    {
      "type": "WEB",
      "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1954-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2013-4311

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2013-4311

Aliases

CVE-2013-4311

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-4311",
    "description": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.",
    "id": "GSD-2013-4311",
    "references": [
      "https://www.suse.com/security/cve/CVE-2013-4311.html",
      "https://access.redhat.com/errata/RHSA-2013:1272",
      "https://advisories.mageia.org/CVE-2013-4311.html",
      "https://linux.oracle.com/cve/CVE-2013-4311.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-4311"
      ],
      "details": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.",
      "id": "GSD-2013-4311",
      "modified": "2023-12-13T01:22:16.181210Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-4311",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://wiki.libvirt.org/page/Maintenance_Releases",
            "refsource": "MISC",
            "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2013-1460.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
          },
          {
            "name": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html",
            "refsource": "MISC",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
          },
          {
            "name": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html",
            "refsource": "MISC",
            "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2013-1272.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2013/09/18/6",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
          },
          {
            "name": "http://www.ubuntu.com/usn/USN-1954-1",
            "refsource": "MISC",
            "url": "http://www.ubuntu.com/usn/USN-1954-1"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.9.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:0.10.2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:libvirt:1.0.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-4311"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20130918 Re: Fwd: [vs-plain] polkit races",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2013/09/18/6"
            },
            {
              "name": "http://wiki.libvirt.org/page/Maintenance_Releases",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://wiki.libvirt.org/page/Maintenance_Releases"
            },
            {
              "name": "RHSA-2013:1272",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1272.html"
            },
            {
              "name": "USN-1954-1",
              "refsource": "UBUNTU",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.ubuntu.com/usn/USN-1954-1"
            },
            {
              "name": "openSUSE-SU-2013:1549",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html"
            },
            {
              "name": "openSUSE-SU-2013:1550",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html"
            },
            {
              "name": "RHSA-2013:1460",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1460.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2019-04-22T17:48Z",
      "publishedDate": "2013-10-03T21:55Z"
    }
  }
}

OPENSUSE-SU-2024:10209-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 19:54

Summary

libvirt-2.5.0-1.1 on GA media

Severity

Moderate

Scope

32 vulnerabilities in this advisory, including CVE-2013-4311.

CVE-2013-4311

Recommended: 112 products

Open the full advisory

RHSA-2013:1272

Vulnerability from csaf_redhat - Published: 2013-09-19 17:58 - Updated: 2026-06-27 12:00

Summary

Red Hat Security Advisory: libvirt security and bug fix update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2013-4311.

CVE-2013-4311

6.9 ()


                
                  AV:L/AC:M/Au:N/C:C/I:C/A:C

Fixed: 72 products

https://access.redhat.com/errata/RHSA-2013:1272

Open the full advisory

RHSA-2013_1272

Vulnerability from csaf_redhat - Published: 2013-09-19 17:58 - Updated: 2024-11-22 07:05

Summary

Red Hat Security Advisory: libvirt security and bug fix update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2013-4311.

CVE-2013-4311

6.9 ()


                
                  AV:L/AC:M/Au:N/C:C/I:C/A:C

Fixed: 224 products

https://access.redhat.com/errata/RHSA-2013:1272

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2013-4311 (GCVE-0-2013-4311)

BDU:2015-09744 (CVE-2013-4288)

FKIE_CVE-2013-4311

GHSA-PR6P-RW96-X62R

GSD-2013-4311

OPENSUSE-SU-2024:10209-1

RHSA-2013:1272

RHSA-2013_1272

Tags

Sightings

Nomenclature

Related by attack behaviour