Published: 07/08/2012 Updated: 13/02/2023

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu 1.0

Debian Bug report logs - #678280 CVE-2012-2652 Package: qemu; Maintainer for qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Source for qemu is src:qemu (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Wed, 20 Jun 2012 15:24:02 UTC Severity: grave Tags: patch ...

QEMU could be made to overwrite files as the administrator, or expose sensitive information ...

Multiple vulnerabilities have been discovered in QEMU, a fast processor emulator The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-2652: The snapshot mode of QEMU (-snapshot) incorrectly handles temporary files used to store the current state, making it vulnerable to symlink attacks (includin ...

Multiple vulnerabilities have been discovered in KVM, a full virtualization solution on x86 hardware The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-2652: The snapshot mode of QEMU (-snapshot) incorrectly handles temporary files used to store the current state, making it vulnerable to symli ...

NVD-CWE-Other http://www.ubuntu.com/usn/USN-1522-1 http://secunia.com/advisories/50132 http://www.securityfocus.com/bid/53725 http://www.debian.org/security/2012/dsa-2545 http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html http://secunia.com/advisories/50689 http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=eba25057b9a5e19d10ace2bc7716667a31297169 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678280 https://usn.ubuntu.com/1522-1/https://nvd.nist.gov

CVE-2012-2652

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect