{"id":"CVE-2011-2527","aliases":["DSA-2282-1","EUVD-2011-2511","GHSA-6g2j-9xh2-rw37","RHSA-2011:1531","SUSE-SU-2015:0929-1"],"status":"published","title":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop...","description":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00439,"percentile":0.38422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2011-07-25T00:00:00Z","modified":"2026-06-28T10:05:27Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.209.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5+dfsg-5+squeeze6"}]}],"versions":["0.12.5+dfsg-5","0.12.5+dfsg-5+squeeze1","0.12.5+dfsg-5+squeeze2","0.12.5+dfsg-5+squeeze3","0.12.5+dfsg-5+squeeze4","0.12.5+dfsg-5+squeeze4~bpo50+1","0.12.5+dfsg-5+squeeze5"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.209.el6"}]}]}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68539","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2011/07/12/5","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/48659","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2011/07/12/15","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2011/dsa-2282","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/47992","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/45419","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://bugs.launchpad.net/qemu/+bug/807893","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-02/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.osvdb.org/74752","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/47157","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/45188","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://ubuntu.com/usn/usn-1177-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://secunia.com/advisories/45187","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081972.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2011-1531.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2527","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6g2j-9xh2-rw37"},{"url":"https://access.redhat.com/errata/RHSA-2011:1531","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/qemu-kvm.html#RHSA-2011-1531","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=561414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=599306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=609342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=621482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=624983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=627585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=633370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=633380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=645351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=655719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=656779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=658467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=669581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=676982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=678729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=678731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=680378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=693645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=681736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=682227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=694373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=694378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=698537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=700134","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=705070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=707130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=709397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=710046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=711354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=712046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=715017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=715141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=715582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=717958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=718664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=722728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=725565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=725625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=725965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=726014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=726015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=726020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=726023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=728120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=728464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=729104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=729572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=729621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=729869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=729969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=731759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=732949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=733010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=733993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=734860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=734995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=735716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=736975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=737921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=738487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=738555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=739480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=740547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=741878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=742484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=743269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=743342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=743391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=744518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=744780","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1531.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2527","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/598271","tags":["report"]},{"url":"https://bugzilla.suse.com/598298","tags":["report"]},{"url":"https://bugzilla.suse.com/599095","tags":["report"]},{"url":"https://bugzilla.suse.com/603161","tags":["report"]},{"url":"https://bugzilla.suse.com/603179","tags":["report"]},{"url":"https://bugzilla.suse.com/610682","tags":["report"]},{"url":"https://bugzilla.suse.com/619991","tags":["report"]},{"url":"https://bugzilla.suse.com/621793","tags":["report"]},{"url":"https://bugzilla.suse.com/626654","tags":["report"]},{"url":"https://bugzilla.suse.com/637297","tags":["report"]},{"url":"https://bugzilla.suse.com/689895","tags":["report"]},{"url":"https://bugzilla.suse.com/690781","tags":["report"]},{"url":"https://bugzilla.suse.com/695510","tags":["report"]},{"url":"https://bugzilla.suse.com/695766","tags":["report"]},{"url":"https://bugzilla.suse.com/698237","tags":["report"]},{"url":"https://bugzilla.suse.com/701161","tags":["report"]},{"url":"https://bugzilla.suse.com/702823","tags":["report"]},{"url":"https://bugzilla.suse.com/704933","tags":["report"]},{"url":"https://bugzilla.suse.com/705095","tags":["report"]},{"url":"https://bugzilla.suse.com/705304","tags":["report"]},{"url":"https://bugzilla.suse.com/740165","tags":["report"]},{"url":"https://bugzilla.suse.com/764526","tags":["report"]},{"url":"https://bugzilla.suse.com/777084","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/877645","tags":["report"]},{"url":"https://bugzilla.suse.com/929339","tags":["report"]},{"url":"https://bugzilla.suse.com/932770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2011-2527","description":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.","status":"published","published":"2012-06-21T15:00:00Z","modified":"2024-08-06T23:00:34.288Z","updated_at":"2026-11-02T14:35:36.252742Z"}],"euvd":[{"id":"EUVD-2011-2511","description":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.","status":"published","published":"2012-06-21T15:00:00Z","modified":"2024-08-06T23:00:34Z","updated_at":"2026-11-03T01:39:55.11051Z"}],"ghsa":[{"id":"GHSA-6g2j-9xh2-rw37","title":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop...","description":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.","status":"published","published":"2022-05-13T01:13:51Z","modified":"2023-02-01T05:04:21Z","updated_at":"2026-11-02T14:50:08.898362Z"}],"nvd":[{"id":"CVE-2011-2527","description":"The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.","status":"published","published":"2012-06-21T15:55:09.863Z","modified":"2026-06-16T23:31:31.273Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:12.272092Z"}],"osv":[{"id":"DSA-2282-1","title":"qemu-kvm - several","status":"published","published":"2011-07-25T00:00:00Z","modified":"2026-03-09T01:19:01.606683Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2011:1531","title":"Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update","status":"published","published":"2024-09-15T19:19:03Z","modified":"2026-06-28T10:05:27Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"SUSE-SU-2015:0929-1","title":"Security update for kvm","description":"\nThe kvm qemu vt100 emulation was affected by a problem where specific vt100 \nsequences could have been used by guest users to affect the host. \n(CVE-2012-3515 aka XSA-17).\n\nAlso a temp file race was fixed. (CVE-2012-2652)\n\nSecurity Issue reference:\n\n    * CVE-2012-3515\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515\u003e\n    * CVE-2012-2652\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652\u003e\n\n","status":"published","published":"2012-08-31T14:36:20Z","modified":"2026-02-04T03:38:26.839919Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}