ALPINE-CVE-2019-10166 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2019-10166 PUBLISHED CVSS 7.800000190734863 HIGH

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

Risk Scores

CVSS v3.1

7.800000190734863

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Alpine:v3.10	libvirt	0, 0.10.0-r0, 0.10.1-r0
Alpine:v3.9	libvirt	4.6.0-r1, 0, 0.10.0-r0
Alpine:v3.11	libvirt	0.10.2-r0, 0.10.1-r1, 3.4.0-r1
Alpine:v3.8	libvirt	0.10.0-r0, 0.10.1-r0, 0.10.1-r1
Alpine:v3.12	libvirt	4.10.0-r0, 0, 0.10.0-r0
Alpine:v3.7	libvirt	3.9.0-r1, 3.9.0-r0, 3.8.0-r0

Timeline

Aug 2, 2019 CVE Published
Nov 19, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2019-10166 advisory

Open in Interactive Console →