CVE

Id
55933  
CVE No.
CVE-2012-2690  
Status
Candidate  
Description
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.  
Phase
Assigned (20120514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
581699 55933 CVE-2012-2690 MLIST:[Libguestfs] 20120521 [ANNOUNCE] libguestfs 1.18 released - tools for managing virtual machines and disk images  View
581700 55933 CVE-2012-2690 URL:https://www.redhat.com/archives/libguestfs/2012-May/msg00104.html  View
581701 55933 CVE-2012-2690 REDHAT:RHSA-2012:0774  View
581702 55933 CVE-2012-2690 URL:http://rhn.redhat.com/errata/RHSA-2012-0774.html  View
581703 55933 CVE-2012-2690 BID:53932  View
581704 55933 CVE-2012-2690 URL:http://www.securityfocus.com/bid/53932  View
581705 55933 CVE-2012-2690 SECUNIA:49431  View
581706 55933 CVE-2012-2690 URL:http://secunia.com/advisories/49431  View
581707 55933 CVE-2012-2690 SECUNIA:49545  View
581708 55933 CVE-2012-2690 URL:http://secunia.com/advisories/49545  View
581709 55933 CVE-2012-2690 XF:libguestfs-virtedit-info-disc(76220)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
27155 JVNDB-2012-002862 Ruby on Rails の Active Record コンポーネントにおける SQL インジェクションの脆弱性 Ruby on Rails の Active Record コンポーネントは、ActiveRecord クラスの where メソッドに対して、リクエストデータの受け渡しを適切に実装していないため、特定の SQL インジェクション攻撃を実行される脆弱性が存在します。 CVE-2012-2695 55933 7.5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002862.html  View