CVE-2010-2794

spice-xpi - Arbitrary File Overwrite via Symlink Attack on Log File

Title source: llm
STIX 2.1

Description

The SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to overwrite arbitrary files via a symlink attack on an unspecified log file.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0651.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=620356
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41120
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2181
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/67620

Scores

EPSS 0.0032
EPSS Percentile 23.6%

Details

CWE
CWE-59
Status published
Products (1)
redhat/spice-xpi 2.2
Published Aug 30, 2010
Tracked Since Feb 18, 2026