Lucene search

[email protected]NVD:CVE-2011-2527

HistoryJun 21, 2012 - 3:55 p.m.

CVE-2011-2527

2012-06-2115:55:09

CWE-264

[email protected]

web.nvd.nist.gov

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.2%

JSON

The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.

Affected configurations

NVD

Node

qemuqemuRange≤0.14.0

qemuqemuMatch0.1.0

qemuqemuMatch0.1.1

qemuqemuMatch0.1.2

qemuqemuMatch0.1.3

qemuqemuMatch0.1.4

qemuqemuMatch0.1.5

qemuqemuMatch0.1.6

qemuqemuMatch0.2.0

qemuqemuMatch0.3.0

qemuqemuMatch0.4.0

qemuqemuMatch0.4.1

qemuqemuMatch0.4.2

qemuqemuMatch0.4.3

qemuqemuMatch0.6.0

qemuqemuMatch0.6.1

qemuqemuMatch0.7.0

qemuqemuMatch0.7.1

qemuqemuMatch0.7.2

qemuqemuMatch0.8.0

qemuqemuMatch0.8.1

qemuqemuMatch0.8.2

qemuqemuMatch0.9.0

qemuqemuMatch0.9.1

qemuqemuMatch0.9.1-5

qemuqemuMatch0.10.0

qemuqemuMatch0.10.1

qemuqemuMatch0.10.2

qemuqemuMatch0.10.3

qemuqemuMatch0.10.4

qemuqemuMatch0.10.5

qemuqemuMatch0.10.6

qemuqemuMatch0.11.0

qemuqemuMatch0.11.0rc0

qemuqemuMatch0.11.0rc1

qemuqemuMatch0.11.0rc2

qemuqemuMatch0.11.0-rc0

qemuqemuMatch0.11.0-rc1

qemuqemuMatch0.11.0-rc2

qemuqemuMatch0.11.1

qemuqemuMatch0.12.0

qemuqemuMatch0.12.0rc1

qemuqemuMatch0.12.0rc2

qemuqemuMatch0.12.1

qemuqemuMatch0.12.2

qemuqemuMatch0.12.3

qemuqemuMatch0.12.4

qemuqemuMatch0.12.5

qemuqemuMatch0.13.0

qemuqemuMatch0.13.0rc0

qemuqemuMatch0.13.0rc1

qemuqemuMatch0.14.0rc0

qemuqemuMatch0.14.0rc1

qemuqemuMatch0.14.0rc2

qemuqemuMatch0.14.1

qemuqemuMatch0.15.0rc1

qemuqemuMatch0.15.0rc2

References

lists.fedoraproject.org/pipermail/package-announce/2012-June/081972.html

lists.opensuse.org/opensuse-updates/2012-02/msg00009.html

rhn.redhat.com/errata/RHSA-2011-1531.html

secunia.com/advisories/45187

secunia.com/advisories/45188

secunia.com/advisories/45419

secunia.com/advisories/47157

secunia.com/advisories/47992

ubuntu.com/usn/usn-1177-1

www.openwall.com/lists/oss-security/2011/07/12/15

www.openwall.com/lists/oss-security/2011/07/12/5

www.osvdb.org/74752

www.securityfocus.com/bid/48659

bugs.launchpad.net/qemu/+bug/807893

exchange.xforce.ibmcloud.com/vulnerabilities/68539

www.debian.org/security/2011/dsa-2282

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.2%

JSON

Related for NVD:CVE-2011-2527

veracode1 openvas10 cve1 nessus8 ubuntucve1 prion1 cvelist1 redhat1 ubuntu1 osv1 oraclelinux1 debian1 securityvulns2 fedora1