CVE-2010-0428

2010-08-2418:00:01

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:S/C:C/I:C/A:C

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

20.8%

JSON

libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.

Affected configurations

Nvd

Node

redhatenterprise_virtualizationMatch2.2

redhatqspiceMatch0.3.0

VendorProductVersionCPE
redhatenterprise_virtualization2.2cpe:2.3:a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*
redhatqspice0.3.0cpe:2.3:a:redhat:qspice:0.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	enterprise_virtualization	2.2	cpe:2.3:a:redhat:enterprise_virtualization:2.2:::::::*
redhat	qspice	0.3.0	cpe:2.3:a:redhat:qspice:0.3.0:::::::*