CVE-2013-2007

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: May 21, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20086.1WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-20098.8WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution CVE-2013-20109.8WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVE-2013-20118.8WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr CVE-2013-20127.3autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.CVE-2013-20132.1The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows loc CVE-2013-20145.0OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple CVE-2013-20154.7The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journa CVE-2013-20167.8A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. CVE-2013-20177.8The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remot CVE-2013-20189.8Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2013-20199.3Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elem