Red Hat Security AdvisoryRHSA-2017:2471
spice security update
Released 2017-08-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) spice-0.12.8-2.el7.1, spice-server-0.12.8-2.el7.1
- Red Hat Enterprise Linux Client Optional (v. 7) spice-server-devel-0.12.8-2.el7.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) spice-0.12.8-2.el7.1, spice-server-0.12.8-2.el7.1, spice-server-devel-0.12.8-2.el7.1
- Red Hat Enterprise Linux Server (v. 7) spice-0.12.8-2.el7.1, spice-server-0.12.8-2.el7.1
- Red Hat Enterprise Linux Server Optional (v. 7) spice-server-devel-0.12.8-2.el7.1
- Red Hat Enterprise Linux Workstation (v. 7) spice-0.12.8-2.el7.1, spice-server-0.12.8-2.el7.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) spice-server-devel-0.12.8-2.el7.1
Fixes 1 record
Priority MEDIUM 45
spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04204 · Published 2017-07-18 · Partial fix CWE-119
