CVE-2012-2652

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function,...

4.4 MediumFix available

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

Exploit likelihood

0.34%Down 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 4.4

Record: CVE-2012-2652
CVSS 2.0: 4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-2652
Updated: 2026-11-02

EUVDEUVD-2012-2638 No score

Record: EUVD-2012-2638
Updated: 2026-11-03

GitHub AdvisoriesGHSA-47rg-xchh-xj5g No score

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function,...

Record: GHSA-47rg-xchh-xj5g
Updated: 2026-11-02

OSV No score

Record: CVE-2012-2652
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-2652 No score

Record: DEBIAN-CVE-2012-2652
Updated: 2026-11-02

OSVSUSE-SU-2015:0929-1 No score

Security update for kvm

The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17).

Also a temp file race was fixed. (CVE-2012-2652)

Security Issue reference:

* CVE-2012-3515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515>
* CVE-2012-2652
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652>

Record: SUSE-SU-2015:0929-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0943-1 No score

Security update for KVM

This update fixes a file permission issue with qga (the QEMU Guest Agent) from the qemu/kvm package and includes several bug-fixes.

(bnc#818182) (CVE-2013-2007) (bnc#786813) (bnc#725008) (bnc#712137) (bnc#824340)

Security Issues:

* CVE-2013-2007
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007>

Record: SUSE-SU-2015:0943-1
Updated: 2026-11-02

Affected products

qemu

Affected packages

Affected packages
Package	Affected	Fixed
`qemu` Debian:12	before 1.1.0+dfsg-1	1.1.0+dfsg-1
`qemu` Debian:13	before 1.1.0+dfsg-1	1.1.0+dfsg-1
`qemu` Debian:14	before 1.1.0+dfsg-1	1.1.0+dfsg-1
`qemu-kvm` Debian:6.0	before 0.12.5+dfsg-5+squeeze9, plus listed versions 0.12.5+dfsg-50.12.5+dfsg-5+squeeze10.12.5+dfsg-5+squeeze20.12.5+dfsg-5+squeeze30.12.5+dfsg-5+squeeze4 Show 5 moreShow less 0.12.5+dfsg-5+squeeze4~bpo50+10.12.5+dfsg-5+squeeze50.12.5+dfsg-5+squeeze60.12.5+dfsg-5+squeeze70.12.5+dfsg-5+squeeze8	0.12.5+dfsg-5+squeeze9
`qemu` Debian:6.0	before 0.12.5+dfsg-3squeeze2, plus listed versions 0.12.5+dfsg-30.12.5+dfsg-3squeeze1	0.12.5+dfsg-3squeeze2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-2652 is a medium vulnerability (CVSS 4.4) in Qemu, published August 7, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in qemu 1.1.0+dfsg-1.

References

Show 64 moreShow less