A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spice | Nov 9, 2018 | Aug 17, 2018 |
| Centos_linux | — | Upgrade spice-glib-develUpgrade spice-server-develUpgrade spice-gtk3-valaUpgrade spice-debuginfoUpgrade spice-gtk-pythonUpgrade spice-gtkUpgrade spice-serverUpgrade spice-server-debuginfoUpgrade spice-gtk-debuginfoUpgrade spice-gtk-develUpgrade spice-gtk3-develUpgrade spice-gtk-toolsUpgrade spice-glibUpgrade spice-gtk3 | Oct 2, 2018 | Aug 17, 2018 |
| Debian | — | Upgrade spice-gtkUpgrade spice | Oct 16, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spice-server | Nov 6, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spice-server | Nov 8, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spice-server | Jan 9, 2019 | Aug 17, 2018 |
| Oracle_linux | — | Upgrade spice-gtk3-develUpgrade spice-gtkUpgrade spice-glibUpgrade spice-serverUpgrade spice-gtk3Upgrade spice-server-develUpgrade spice-gtk-pythonUpgrade spice-gtk-toolsUpgrade spice-gtk3-valaUpgrade spice-gtk-develUpgrade spice-glib-devel | Sep 21, 2018 | Aug 16, 2018 |
| Redhat_linux | — | Upgrade spice-serverUpgrade spice-gtk3-develUpgrade spice-glibUpgrade spice-server-develUpgrade spice-gtk3Upgrade spice-gtk-toolsUpgrade spice-debuginfoUpgrade spice-gtk-pythonUpgrade spice-gtkUpgrade spice-glib-develUpgrade spice-gtk-debuginfoUpgrade spice-gtk3-valaUpgrade spice-gtk-develUpgrade spice-server-debuginfo | Sep 24, 2018 | Aug 17, 2018 |
| Suse | — | Upgrade libspice-client-glib-helperUpgrade libspice-client-gtk-3_0-5Upgrade spice-gtk-develUpgrade libspice-client-gtk-3_0-4Upgrade libspice-client-glib-2_0-8Upgrade typelib-1_0-SpiceClientGtk-3_0Upgrade spice-gtk-langUpgrade typelib-1_0-SpiceClientGlib-2_0Upgrade libspice-server-develUpgrade libspice-controller0Upgrade libspice-client-gtk-2_0-4Upgrade libspice-server1Upgrade spice-gtk | Aug 31, 2018 | Aug 17, 2018 |
| Ubuntu | — | Upgrade libspice-server1Upgrade libspice-protocol-dev | Aug 31, 2018 | Aug 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub