CVE-2013-2007

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-20086.1WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-20098.8WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionCVE-2013-20109.8WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityCVE-2013-20118.8WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrCVE-2013-20127.3autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.CVE-2013-20132.1The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows locCVE-2013-20145.0OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multipleCVE-2013-20154.7The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journaCVE-2013-20167.8A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. CVE-2013-20177.8The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remotCVE-2013-20189.8Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2013-20199.3Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elem
CVE-2013-2007: Medium severity, CVSS 6.9 | Vulnix