CVE-2012-2690 virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users....
LowCVSS 2.1
EPSS 0.41%
- Published
- Updated
- Exploit status
- No public exploit known
Description
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libguestfs(Debian:12) | < 1:1.18.0-1 | 1:1.18.0-1 |
| debian/libguestfs(Debian:13) | < 1:1.18.0-1 | 1:1.18.0-1 |
| debian/libguestfs(Debian:14) | < 1:1.18.0-1 | 1:1.18.0-1 |
| libguestfs | <= 1.17.43 | No fix listed |
| libguestfs | = 1.16.0 | No fix listed |
| libguestfs | = 1.16.1 | No fix listed |
| libguestfs | = 1.16.2 | No fix listed |
| libguestfs | = 1.16.3 | No fix listed |
| libguestfs | = 1.16.4 | No fix listed |
| libguestfs | = 1.16.5 | No fix listed |
| libguestfs | = 1.16.6 | No fix listed |
| libguestfs | = 1.16.7 | No fix listed |
| libguestfs | = 1.16.8 | No fix listed |
| libguestfs | = 1.16.9 | No fix listed |
| libguestfs | = 1.16.10 | No fix listed |
| libguestfs | = 1.16.11 | No fix listed |
| libguestfs | = 1.16.12 | No fix listed |
| libguestfs | = 1.16.13 | No fix listed |
| libguestfs | = 1.16.14 | No fix listed |
| libguestfs | = 1.16.15 | No fix listed |
| libguestfs | = 1.16.16 | No fix listed |
| libguestfs | = 1.16.17 | No fix listed |
| libguestfs | = 1.16.18 | No fix listed |
| libguestfs | = 1.16.19 | No fix listed |
| libguestfs | = 1.16.20 | No fix listed |
Show 49 more
| Product | Affected versions | Fixed in |
|---|---|---|
| libguestfs | = 1.16.21 | No fix listed |
| libguestfs | = 1.16.22 | No fix listed |
| libguestfs | = 1.16.23 | No fix listed |
| libguestfs | = 1.16.24 | No fix listed |
| libguestfs | = 1.16.25 | No fix listed |
| libguestfs | = 1.16.26 | No fix listed |
| libguestfs | = 1.17.0 | No fix listed |
| libguestfs | = 1.17.1 | No fix listed |
| libguestfs | = 1.17.2 | No fix listed |
| libguestfs | = 1.17.3 | No fix listed |
| libguestfs | = 1.17.4 | No fix listed |
| libguestfs | = 1.17.5 | No fix listed |
| libguestfs | = 1.17.6 | No fix listed |
| libguestfs | = 1.17.7 | No fix listed |
| libguestfs | = 1.17.8 | No fix listed |
| libguestfs | = 1.17.9 | No fix listed |
| libguestfs | = 1.17.10 | No fix listed |
| libguestfs | = 1.17.11 | No fix listed |
| libguestfs | = 1.17.12 | No fix listed |
| libguestfs | = 1.17.13 | No fix listed |
| libguestfs | = 1.17.14 | No fix listed |
| libguestfs | = 1.17.15 | No fix listed |
| libguestfs | = 1.17.16 | No fix listed |
| libguestfs | = 1.17.17 | No fix listed |
| libguestfs | = 1.17.18 | No fix listed |
| libguestfs | = 1.17.19 | No fix listed |
| libguestfs | = 1.17.20 | No fix listed |
| libguestfs | = 1.17.21 | No fix listed |
| libguestfs | = 1.17.22 | No fix listed |
| libguestfs | = 1.17.23 | No fix listed |
| libguestfs | = 1.17.24 | No fix listed |
| libguestfs | = 1.17.25 | No fix listed |
| libguestfs | = 1.17.26 | No fix listed |
| libguestfs | = 1.17.27 | No fix listed |
| libguestfs | = 1.17.28 | No fix listed |
| libguestfs | = 1.17.29 | No fix listed |
| libguestfs | = 1.17.30 | No fix listed |
| libguestfs | = 1.17.31 | No fix listed |
| libguestfs | = 1.17.32 | No fix listed |
| libguestfs | = 1.17.33 | No fix listed |
| libguestfs | = 1.17.34 | No fix listed |
| libguestfs | = 1.17.35 | No fix listed |
| libguestfs | = 1.17.36 | No fix listed |
| libguestfs | = 1.17.37 | No fix listed |
| libguestfs | = 1.17.38 | No fix listed |
| libguestfs | = 1.17.39 | No fix listed |
| libguestfs | = 1.17.40 | No fix listed |
| libguestfs | = 1.17.41 | No fix listed |
| libguestfs | = 1.17.42 | No fix listed |
References
- Debian Security Tracker CVE-2012-2690 vendor-advisory
- RHSA-2012:0774 vendor-advisory
- 49431 third-party-advisory vendor-advisory
- 49545 third-party-advisory vendor-advisory
- 53932 vdb-entry
- libguestfs-virtedit-info-disc(76220) vdb-entry
- [Libguestfs] 20120521 [ANNOUNCE] libguestfs 1.18 released - tools for managing virtual machines and disk images mailing-list