A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade spice | Nov 9, 2018 | Aug 17, 2018 |
| Centos_linux | — | Upgrade spice-glibUpgrade spice-gtk-toolsUpgrade spice-gtk3Upgrade spice-gtk3-develUpgrade spice-glib-develUpgrade spice-server-develUpgrade spice-debuginfoUpgrade spice-serverUpgrade spice-gtkUpgrade spice-gtk3-valaUpgrade spice-gtk-pythonUpgrade spice-gtk-develUpgrade spice-gtk-debuginfoUpgrade spice-server-debuginfo | Oct 2, 2018 | Aug 17, 2018 |
| Debian | — | Upgrade spice-gtkUpgrade spice | Oct 16, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spice-server | Nov 6, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spice-server | Nov 8, 2018 | Aug 17, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spice-server | Jan 9, 2019 | Aug 17, 2018 |
| Oracle_linux | — | Upgrade spice-gtk3-valaUpgrade spice-gtk-develUpgrade spice-glib-develUpgrade spice-gtk-toolsUpgrade spice-gtk3-develUpgrade spice-glibUpgrade spice-gtk3Upgrade spice-gtk-pythonUpgrade spice-server-develUpgrade spice-serverUpgrade spice-gtk | Sep 21, 2018 | Aug 16, 2018 |
| Redhat_linux | — | Upgrade spice-gtk3Upgrade spice-gtk-pythonUpgrade spice-serverUpgrade spice-gtk-toolsUpgrade spice-gtkUpgrade spice-gtk3-develUpgrade spice-server-develUpgrade spice-glibUpgrade spice-debuginfoUpgrade spice-gtk-debuginfoUpgrade spice-glib-develUpgrade spice-gtk3-valaUpgrade spice-gtk-develUpgrade spice-server-debuginfo | Sep 24, 2018 | Aug 17, 2018 |
| Suse | — | Upgrade libspice-client-glib-helperUpgrade spice-gtk-develUpgrade libspice-client-glib-2_0-8Upgrade typelib-1_0-SpiceClientGtk-3_0Upgrade libspice-client-gtk-3_0-5Upgrade spice-gtk-langUpgrade libspice-client-gtk-3_0-4Upgrade libspice-server-develUpgrade spice-gtkUpgrade libspice-client-gtk-2_0-4Upgrade typelib-1_0-SpiceClientGlib-2_0Upgrade libspice-controller0Upgrade libspice-server1 | Aug 31, 2018 | Aug 17, 2018 |
| Ubuntu | — | Upgrade libspice-server1Upgrade libspice-protocol-dev | Aug 31, 2018 | Aug 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub