CVE-2010-2792 Race condition in n/a

Low 3.3 Published 30 Aug 2010 Updated 7 Aug 2024

Local attackers can exploit a race condition in the SPICE Firefox plugin to access sensitive data and perform man-in-the-middle attacks via UNIX sockets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2010-2792?

CVE-2010-2792 is a low-severity vulnerability in n/a, published on 30 Aug 2010. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.

Weakness: CWE-362

Which versions are affected by CVE-2010-2792?

It affects 1 product.

Linux distribution packages (4)

`qspice-client` Red Hat:enterprise_linux:5::client	All versions	`0:0.3.0-4.el5_5`
`qspice-client-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:0.3.0-4.el5_5`
`qspice-client` Red Hat:rhel_productivity:5	All versions	`0:0.3.0-4.el5_5`
`qspice-client-debuginfo` Red Hat:rhel_productivity:5	All versions	`0:0.3.0-4.el5_5`

Products include Redhat Spice-Xpi.

How do I fix CVE-2010-2792?

Apply the vendor's patch.

Is CVE-2010-2792 being exploited?

There is no known exploitation of CVE-2010-2792 in the wild and no public exploit code.

Sources

Also known as GHSA-jj4v-3jp4-pvcr, RHSA-2010:0632.