CVE-2016-9638

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.

• CWE-264

• http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrolExploit, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95009Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037385
• http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrolExploit, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/95009Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037385

Published

Dec 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9632An issue was discovered in the Tatsuya Kinoshita w3m fork be…
• CVE-2016-9633An issue was discovered in the Tatsuya Kinoshita w3m fork be…
• CVE-2016-9634Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9635Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9636Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9637The (1) ioport_read and (2) ioport_write functions in Xen, w…
• CVE-2016-9639Salt before 2015.8.11 allows deleted minions to read or writ…
• CVE-2016-9642JavaScriptCore in WebKit allows attackers to cause a denial …
• CVE-2016-9643The regex code in Webkit 2.4.11 allows remote attackers to c…
• CVE-2016-9644The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.…
• CVE-2016-9645The fix for ikiwiki for CVE-2016-10026 was incomplete result…
• CVE-2016-9646ikiwiki before 3.20161229 incorrectly called the CGI::FormBu…