CVE-2012-2652: Medium severity Qemu Qemu vulnerability
Published Aug 7, 2012
·Updated
The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.
Affected Software
1 affected component
Qemu Qemu=1.0
Event History
Aug 7, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2652?
CVE-2012-2652 is classified as a medium severity vulnerability.
2
How do I fix CVE-2012-2652?
To fix CVE-2012-2652, upgrade QEMU to version 1.1 or later where the vulnerability is addressed.
3
What is the impact of CVE-2012-2652?
The impact of CVE-2012-2652 is that it allows local users to overwrite or read arbitrary files due to a symlink attack.
4
Which versions of QEMU are affected by CVE-2012-2652?
CVE-2012-2652 affects QEMU version 1.0 specifically.
5
What is the cause of CVE-2012-2652?
CVE-2012-2652 is caused by improper handling of the mkstemp function failure within the bdrv_open function in QEMU.