CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2012-0860 – rhev: vds_installer insecure /tmp use
https://notcve.org/view.php?id=CVE-2012-0860
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/. Múltiples vulnerabilidades de path de búsqueda no confiable en Red Hat Enterprise Virtualization Manager (RHEV-M) anteriores a v3.1, cuando se añade un host, permite a usuario locales obtener privilegios a través de un fichero (1) deployUtil.py o (2) el módulo en Phyton en /tmp/.. • http://rhn.redhat.com/errata/RHSA-2012-1506.html http://rhn.redhat.com/errata/RHSA-2012-1508.html http://www.securityfocus.com/bid/56825 http://www.securitytracker.com/id?1027838 https://bugzilla.redhat.com/show_bug.cgi?id=790730 https://exchange.xforce.ibmcloud.com/vulnerabilities/80543 https://access.redhat.com/security/cve/CVE-2012-0860 • CWE-377: Insecure Temporary File •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2012-0861 – rhev: vds_installer is prone to MITM when downloading 2nd stage installer
https://notcve.org/view.php?id=CVE-2012-0861
The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack. El vds_installer en Red Hat Enterprise Virtualization Manager (RHEV-M) anteriores a v3.1, cuando se añade un host, usa el parámetro "-k curl" cuando se descarga deployUtil.py y vds_bootstrap.py, lo que evita que los certificados SSL seran validados y permite a atacantes remotos a ejecutar código Python a través de un ataque "Man in the Middle". • http://rhn.redhat.com/errata/RHSA-2012-1505.html http://rhn.redhat.com/errata/RHSA-2012-1506.html http://rhn.redhat.com/errata/RHSA-2012-1508.html http://www.securityfocus.com/bid/56825 http://www.securitytracker.com/id?1027838 https://exchange.xforce.ibmcloud.com/vulnerabilities/80544 https://access.redhat.com/security/cve/CVE-2012-0861 https://bugzilla.redhat.com/show_bug.cgi?id=790754 • CWE-295: Improper Certificate Validation CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2010-2793 – spice activex/spicec named pipe races
https://notcve.org/view.php?id=CVE-2010-2793
Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function. Condición de carrera en el plug-in SPICE (también conocido como spice-activex) para Internet Explorer en Red Hat Enterprise Virtualization (RHEV) Manager, en versiones anteriores a la 2.2.4, permite a usuarios locales crear una cierta tubería (pipe), y obtener privilegios, mediante vectores involucrados en el conocimiento del nombre de esta tubería junto con el uso de la función ImpersonateNamedPipeClient. • http://securitytracker.com/id?1024825 http://www.securityfocus.com/bid/45213 https://bugzilla.redhat.com/show_bug.cgi?id=620355 https://rhn.redhat.com/errata/RHSA-2010-0818.html https://access.redhat.com/security/cve/CVE-2010-2793 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2010-0428 – libspice: Insufficient guest provided pointers validation
https://notcve.org/view.php?id=CVE-2010-0428
libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors. libspice, tal y como se utiliza en QEMU-KVM en el Hypervisor (alias rhev-hipervisor) de Red Hat Enterprise Virtualization (RHEV) v2.2 y qspice v0.3.0, no valida correctamente los punteros a controladores QXL, lo que permite causar, a los usuarios de los sistemas operativos Huesped, una denegación de servicio (uso de puntero no válido y la caída del sistema operativo huésped) o posiblemente ganar privilegios a través de vectores no especificados. • https://bugzilla.redhat.com/show_bug.cgi?id=568699 https://rhn.redhat.com/errata/RHSA-2010-0622.html https://rhn.redhat.com/errata/RHSA-2010-0633.html https://access.redhat.com/security/cve/CVE-2010-0428 • CWE-20: Improper Input Validation •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2010-0429 – libspice: Relying on guest provided data structures to indicate memory allocation
https://notcve.org/view.php?id=CVE-2010-0429
libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors. libspice, tal y como se utiliza en QEMU-KVM en el Hypervisor (alias rhev-hipervisor) en Red Hat Enterprise Virtualization (RHEV) v2.2 y qspice v0.3.0, no restringe adecuadamanete las direcciones sobre las que las acciones de gestion de memoria son llevadas a cabo, lo que permite causar, a los usuarios del sistema operativo Huesped, una denegación de servicio (caida del sistema operativo Huesped) o posiblemente obtener privilegios mediante vectores no especificados. • https://bugzilla.redhat.com/show_bug.cgi?id=568701 https://rhn.redhat.com/errata/RHSA-2010-0622.html https://rhn.redhat.com/errata/RHSA-2010-0633.html https://access.redhat.com/security/cve/CVE-2010-0429 • CWE-264: Permissions, Privileges, and Access Controls •