CVE-2010-2492: avaya aura_communication_manager

Modified

Published 08-09-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-2492 is a high (CVSS 7.8) vulnerability in avaya aura_communication_manager. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

DSA-2110-1 RHSA-2010:0723 RHSA-2011:0007

Timeline

08-09-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.

CVSS metrics

2 scores · 1 source · 2 versions

v3.17.8v2.07.2

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Avaya7 products

aura_communication_manager5.2
aura_presence_services6.0 | 6.1 | 6.1.1
aura_session_manager1.1 | 5.2 | 6.0
aura_system_manager5.2 | 6.0 | 6.1 | 6.1.1
aura_system_platform_firmware1.1 | 6.0 | 6.0:sp1

Show all 7

Linux1 product

linux_kernel< 2.6.35

Vmware1 product

esx4.0 | 4.1

3 vendors · 9 products

References

12 links

www.redhat.com/support/errata/RHSA-2010-0723.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.securityfocus.com/archive/1/520102/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/46397Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2010:198Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/support/errata/RHSA-2011-0007.htmlVendor AdvisoryX Refsource REDHATBroken Link
bugzilla.redhat.com/show_bug.cgi?id=611385X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35X Refsource CONFIRMBroken Link
git.kernel.orgX Refsource CONFIRM
www.vmware.com/security/advisories/VMSA-2011-0012.htmlX Refsource CONFIRMPatchThird Party Advisory
support.avaya.com/css/P8/documents/100113326X Refsource CONFIRMThird Party Advisory

Show all 12 references

secunia.com/advisories/42890Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2010:172Vendor AdvisoryX Refsource MANDRIVABroken Link