Red Hat Security Advisory

RHSA-2018:2732

spice-gtk and spice-server security update

Released 2018-09-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) spice-glib-0.26-8.el6_10.1, spice-gtk-0.26-8.el6_10.1, spice-gtk-python-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux Desktop Optional (v. 6) spice-glib-devel-0.26-8.el6_10.1, spice-gtk-devel-0.26-8.el6_10.1, spice-gtk-tools-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux HPC Node (v. 6) spice-glib-0.26-8.el6_10.1, spice-gtk-0.26-8.el6_10.1, spice-gtk-python-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux HPC Node Optional (v. 6) spice-glib-devel-0.26-8.el6_10.1, spice-gtk-devel-0.26-8.el6_10.1, spice-gtk-tools-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux Server (v. 6) spice-glib-0.26-8.el6_10.1, spice-gtk-0.26-8.el6_10.1, spice-gtk-python-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux Server Optional (v. 6) spice-glib-devel-0.26-8.el6_10.1, spice-gtk-devel-0.26-8.el6_10.1, spice-gtk-tools-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux Workstation (v. 6) spice-glib-0.26-8.el6_10.1, spice-gtk-0.26-8.el6_10.1, spice-gtk-python-0.26-8.el6_10.1 +1
Red Hat Enterprise Linux Workstation Optional (v. 6) spice-glib-devel-0.26-8.el6_10.1, spice-gtk-devel-0.26-8.el6_10.1, spice-gtk-tools-0.26-8.el6_10.1 +1

Fixes 1 record

TI-2018-07687 CVE-2018-10873 · GHSA-2r4x-v526-vv9j

Memory corruption in [UNKNOWN] spice:

MEDIUM 45

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.03934 Published 2018-08-17 Fixed CWE-119