CVE-2010-2792: Red Hat Spice-Xpi

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.

Affected products

• Red Hat Spice-Xpi: version 2.2 only

Published 2010-08-30. Last modified 2026-06-16.