Red Hat Security AdvisoryRHSA-2015:1889
spice-server security update
Released 2015-10-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) spice-server-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux Desktop Optional (v. 6) spice-server-devel-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux HPC Node (v. 6) spice-server-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) spice-server-devel-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux Server (v. 6) spice-server-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux Server Optional (v. 6) spice-server-devel-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux Workstation (v. 6) spice-server-0.12.4-12.el6_7.3
- Red Hat Enterprise Linux Workstation Optional (v. 6) spice-server-devel-0.12.4-12.el6_7.3
Fixes 2 records
Priority LOW 35
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands relat…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00553 · Published 2016-06-07 · Fixed CWE-119
Priority LOW 32
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
CVSS 3.0HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00467 · Published 2016-06-07 · Fixed CWE-119
