Unrated severityNVD Advisory· Published Nov 2, 2013· Updated Jun 16, 2026

CVE-2013-4401

Description

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Libvirt4 versions
cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:libvirt:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:libvirt:1.1.3:*:*:*:*:*:*:*
Libvirt/Libvirtllm-fuzzy
Range: >=1.1.0, <=1.1.3
osv-coords
pkg:rpm/opensuse/libvirt&distro=openSUSE%20Tumbleweed
Range: < 2.5.0-1.1

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdPatch
secunia.com/advisories/55210nvdVendor Advisory
libvirt.org/git/nvd
secunia.com/advisories/60895nvd
security.gentoo.org/glsa/glsa-201412-04.xmlnvd
wiki.libvirt.org/page/Maintenance_Releasesnvd
www.securitytracker.com/id/1029241nvd
www.ubuntu.com/usn/USN-2026-1nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000