PT-2011-1115 · Mozilla+1 · Spice Firefox Plug-In+1

Petr Matousek · Published 2011-04-07 · Updated 2024-03-12 · CVE-2011-0012

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SPICE Firefox plug-in (spice-xpi) versions 2.2 through 2.4

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name. Multiple vulnerabilities in the spice-xpi package may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For versions 2.2 through 2.4, consider restricting access to the usbrdrctl log file to prevent symlink attacks until a patch is available. As a temporary workaround, consider disabling the spice-xpi plug-in until a fix is provided to prevent potential exploitation of the vulnerabilities.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2015-06538

BDU:2015-06539

CVE-2011-0012

RHSA-2011:0426

RHSA-2011_0426

ROSA-SA-2024-2370

Affected Products

Red Hat

Spice Firefox Plug-In

References · 61

• https://nvd.nist.gov/vuln/detail/CVE-2009-2404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-0896 · Security Note
• https://bdu.fstec.ru/vul/2015-01737 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3478 · Security Note
• https://bdu.fstec.ru/vul/2015-02793 · Security Note
• http://vupen.com/english/advisories/2011/0899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1597 · Security Note
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• https://bdu.fstec.ru/vul/2015-06538 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-1970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-0012 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2469 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-5274 · Security Note