CVE-2019-10167

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

• CWE-250
• CWE-284
• CWE-22
• CWE-862

• https://access.redhat.com/libvirt-privesc-vulnerabilitiesVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202003-18Third Party Advisory
• https://access.redhat.com/libvirt-privesc-vulnerabilitiesVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202003-18Third Party Advisory

Published

Aug 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10161It was discovered that libvirtd before versions 4.10.1 and 5…7.8
• CVE-2019-10162A vulnerability has been found in PowerDNS Authoritative Ser…7.5
• CVE-2019-10163A Vulnerability has been found in PowerDNS Authoritative Ser…4.3
• CVE-2019-10164PostgreSQL versions 10.x before 10.9 and versions 11.x befor…8.8
• CVE-2019-10165OpenShift Container Platform before version 4.1.3 writes OAu…2.3
• CVE-2019-10166It was discovered that libvirtd, versions 4.x.x before 4.10.…7.8
• CVE-2019-10168The virConnectBaselineHypervisorCPU() and virConnectCompareH…7.8
• CVE-2019-10169A flaw was found in Keycloak’s user-managed access interface…7.2
• CVE-2019-1017An elevation of privilege vulnerability exists in Windows wh…7
• CVE-2019-10170A flaw was found in the Keycloak admin console, where the re…7.2
• CVE-2019-10171It was found that the fix for CVE-2018-14648 in 389-ds-base,…7.5
• CVE-2019-10172A flaw was found in org.codehaus.jackson:jackson-mapper-asl:…7.5