What is CVE-2013-2016?

CVE-2013-2016 is a high-severity vulnerability in Novell Open Desktop Server, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2019-12-30.

How severe is CVE-2013-2016?

High severity. CVSS v3 base score is 7.8 out of 10.

Privilege escalation in Novell Open Desktop Server

CVE-2013-2016

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

Vulnerability class: Privilege Escalation

Published 2019-12-30 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (40.7th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Novell Open Desktop Server — versions 11.0
Novell Open Enterprise Server — versions 11.0
Qemu — versions 1.5.0
Qemu (Virtio-Rng) — versions v1.3.0 and later
Debian Linux — versions 8.0, 9.0, 10.0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

security-tracker.debian.org/tracker/CVE-2013-2016 (Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Exploit, Issue Tracking)
access.redhat.com/security/cve/cve-2013-2016 (Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2014-05/msg00002.html (Patch, Mailing List, Third Party Advisory)
www.openwall.com/lists/oss-security/2013/04/29/5 (Exploit, Mailing List, Third Party Advisory)
www.openwall.com/lists/oss-security/2013/04/29/6 (Exploit, Mailing List, Third Party Advisory)
www.securityfocus.com/bid/59541 (VDB Entry, Third Party Advisory)
exchange.xforce.ibmcloud.com/vulnerabilities/83850 (VDB Entry, Third Party Advisory)
github.com/qemu/qemu/commit/5f5a1318653c08e435cfa52f60b6a712815b659d (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2013-2016?: CVE-2013-2016 is a high-severity vulnerability in Novell Open Desktop Server, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2019-12-30.
How severe is CVE-2013-2016?: High severity. CVSS v3 base score is 7.8 out of 10.