CVE-2011-0012

2011-04-1817:55:00

CWE-59

[email protected]

web.nvd.nist.gov

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

AI Score

6.2

Confidence

Low

EPSS

Percentile

5.1%

JSON

The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name.

Affected configurations

Nvd

Node

redhatspice-xpiMatch2.2

redhatspice-xpiMatch2.3

redhatspice-xpiMatch2.4

AND

mozillafirefox

VendorProductVersionCPE
redhatspice-xpi2.2cpe:2.3:a:redhat:spice-xpi:2.2:*:*:*:*:*:*:*
redhatspice-xpi2.3cpe:2.3:a:redhat:spice-xpi:2.3:*:*:*:*:*:*:*
redhatspice-xpi2.4cpe:2.3:a:redhat:spice-xpi:2.4:*:*:*:*:*:*:*
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	spice-xpi	2.2	cpe:2.3:a:redhat:spice-xpi:2.2:::::::*
redhat	spice-xpi	2.3	cpe:2.3:a:redhat:spice-xpi:2.3:::::::*
redhat	spice-xpi	2.4	cpe:2.3:a:redhat:spice-xpi:2.4:::::::*
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::