CVE-2010-2793: Red Hat Enterprise Virtualization Manager

Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days.

Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function.

Affected products

• Red Hat Enterprise Virtualization Manager: up to and including 2.2.3; version 2.1 only; version 2.2 only
• Red Hat Spice-Activex: affected versions not specified

Published 2010-12-08. Last modified 2026-06-16.