A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spice | Nov 9, 2018 | Aug 17, 2018 |
| Centos_linux | — | Upgrade spice-glibUpgrade spice-gtk3-develUpgrade spice-gtk-toolsUpgrade spice-gtk3Upgrade spice-gtk-pythonUpgrade spice-server-develUpgrade spice-gtk3-valaUpgrade spice-debuginfoUpgrade spice-glib-develUpgrade spice-serverUpgrade spice-gtkUpgrade spice-server-debuginfoUpgrade spice-gtk-develUpgrade spice-gtk-debuginfo | Oct 2, 2018 | Aug 17, 2018 |
| Debian | — | Upgrade spice-gtkUpgrade spice | Oct 16, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spice-server | Nov 6, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spice-server | Nov 8, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spice-server | Jan 9, 2019 | Aug 17, 2018 |
| Oracle_linux | — | Upgrade spice-gtk3-valaUpgrade spice-glib-develUpgrade spice-gtk-develUpgrade spice-gtk-toolsUpgrade spice-gtk-pythonUpgrade spice-gtkUpgrade spice-serverUpgrade spice-gtk3-develUpgrade spice-glibUpgrade spice-gtk3Upgrade spice-server-devel | Sep 21, 2018 | Aug 16, 2018 |
| Redhat_linux | — | Upgrade spice-gtk3Upgrade spice-gtkUpgrade spice-gtk-toolsUpgrade spice-debuginfoUpgrade spice-glibUpgrade spice-server-develUpgrade spice-gtk-pythonUpgrade spice-serverUpgrade spice-gtk3-develUpgrade spice-server-debuginfoUpgrade spice-glib-develUpgrade spice-gtk-debuginfoUpgrade spice-gtk-develUpgrade spice-gtk3-vala | Sep 24, 2018 | Aug 17, 2018 |
| Suse | — | Upgrade spice-gtk-langUpgrade libspice-client-glib-helperUpgrade typelib-1_0-SpiceClientGtk-3_0Upgrade libspice-client-gtk-3_0-5Upgrade spice-gtk-develUpgrade libspice-client-glib-2_0-8Upgrade libspice-client-gtk-3_0-4Upgrade libspice-server1Upgrade libspice-client-gtk-2_0-4Upgrade spice-gtkUpgrade typelib-1_0-SpiceClientGlib-2_0Upgrade libspice-controller0Upgrade libspice-server-devel | Aug 31, 2018 | Aug 17, 2018 |
| Ubuntu | — | Upgrade libspice-protocol-devUpgrade libspice-server1 | Aug 31, 2018 | Aug 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub