Red Hat Security AdvisoryRHSA-2016:1205
spice security update
Released 2016-06-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) spice-0.12.4-15.el7_2.1, spice-server-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux Client Optional (v. 7) spice-server-devel-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) spice-0.12.4-15.el7_2.1, spice-server-0.12.4-15.el7_2.1, spice-server-devel-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux Server (v. 7) spice-0.12.4-15.el7_2.1, spice-server-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux Server Optional (v. 7) spice-server-devel-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux Workstation (v. 7) spice-0.12.4-15.el7_2.1, spice-server-0.12.4-15.el7_2.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) spice-server-devel-0.12.4-15.el7_2.1
Fixes 2 records
Priority MEDIUM 53
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-b…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08492 · Published 2016-06-09 · Partial fix CWE-119
Priority LOW 31
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.
CVSS 3.0HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00363 · Published 2016-06-09 · Fixed CWE-284
