CVE-2013-2124 Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
MediumCVSS 4.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libguestfs(Debian:12) | < 1:1.20.8-1 | 1:1.20.8-1 |
| debian/libguestfs(Debian:13) | < 1:1.20.8-1 | 1:1.20.8-1 |
| debian/libguestfs(Debian:14) | < 1:1.20.8-1 | 1:1.20.8-1 |
| libguestfs | = 1.20.0 | No fix listed |
| libguestfs | = 1.20.1 | No fix listed |
| libguestfs | = 1.20.2 | No fix listed |
| libguestfs | = 1.20.3 | No fix listed |
| libguestfs | = 1.20.4 | No fix listed |
| libguestfs | = 1.20.5 | No fix listed |
| libguestfs | = 1.20.6 | No fix listed |
| libguestfs | = 1.21.1 | No fix listed |
| libguestfs | = 1.21.2 | No fix listed |
| libguestfs | = 1.21.3 | No fix listed |
| libguestfs | = 1.21.4 | No fix listed |
| libguestfs | = 1.21.5 | No fix listed |
| libguestfs | = 1.21.6 | No fix listed |
| libguestfs | = 1.21.7 | No fix listed |
| libguestfs | = 1.21.8 | No fix listed |
| libguestfs | = 1.21.9 | No fix listed |
| libguestfs | = 1.21.10 | No fix listed |
| libguestfs | = 1.21.11 | No fix listed |
| libguestfs | = 1.21.12 | No fix listed |
| libguestfs | = 1.21.13 | No fix listed |
| libguestfs | = 1.21.14 | No fix listed |
| libguestfs | = 1.21.15 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| libguestfs | = 1.21.16 | No fix listed |
| libguestfs | = 1.21.17 | No fix listed |
| libguestfs | = 1.21.18 | No fix listed |
| libguestfs | = 1.21.19 | No fix listed |
| libguestfs | = 1.21.20 | No fix listed |
| libguestfs | = 1.21.21 | No fix listed |
| libguestfs | = 1.21.22 | No fix listed |
| libguestfs | = 1.21.23 | No fix listed |
| libguestfs | = 1.21.24 | No fix listed |
| libguestfs | = 1.21.25 | No fix listed |
| libguestfs | = 1.21.26 | No fix listed |
| libguestfs | = 1.21.27 | No fix listed |
| libguestfs | = 1.21.28 | No fix listed |
| libguestfs | = 1.21.29 | No fix listed |
| libguestfs | = 1.21.30 | No fix listed |
| libguestfs | = 1.21.31 | No fix listed |
| libguestfs | = 1.21.32 | No fix listed |
| libguestfs | = 1.21.33 | No fix listed |
| libguestfs | = 1.21.34 | No fix listed |
| libguestfs | = 1.21.35 | No fix listed |
| libguestfs | = 1.21.36 | No fix listed |
| libguestfs | = 1.21.37 | No fix listed |
| libguestfs | = 1.21.38 | No fix listed |
| libguestfs | = 1.21.39 | No fix listed |
| libguestfs | = 1.21.40 | No fix listed |
| libguestfs | = 1.22.0 | No fix listed |
| libguestfs | = 1.23.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-2124 vendor-advisory
- 93724 vdb-entry
- [oss-security] 20130529 Re: Re: CVE Request -- libguestfs (1.20.6 | 1.22.0 | 1.23.0 <= X < 1.22.1 | 1.23.1): Denial of service due to a double-free when inspecting certain guest files / images mailing-list patch
- 60205 vdb-entry
- libguestfs-cve20132124-inspectfs-dos(85145) vdb-entry
- github.com exploit patch
- [Libguestfs] 20130528 ATTN: Denial of service attack possible on libguestfs 1.21.x, libguestfs.1.22.0 mailing-list patch
- [Libguestfs] 20130528 Re: ATTN: Denial of service attack possible on libguestfs 1.21.x, libguestfs.1.22.0 mailing-list patch
- bugs.debian.org issue-tracking