VULNERABILITY INTELLIGENCE

CVE-2010-2792

CVSS score3.3 LOW
EPSS probability0.25%
CISA KEVNot currently listed
Published2010-08-30
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:N/C:P/I:P/A:N

Description

Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references