Red Hat Security Advisory

RHSA-2018:3522

spice-server security update

Released 2018-11-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) spice-server-0.12.4-16.el6_10.2
Red Hat Enterprise Linux Desktop Optional (v. 6) spice-server-devel-0.12.4-16.el6_10.2
Red Hat Enterprise Linux HPC Node (v. 6) spice-server-0.12.4-16.el6_10.2
Red Hat Enterprise Linux HPC Node Optional (v. 6) spice-server-devel-0.12.4-16.el6_10.2
Red Hat Enterprise Linux Server (v. 6) spice-server-0.12.4-16.el6_10.2
Red Hat Enterprise Linux Server Optional (v. 6) spice-server-devel-0.12.4-16.el6_10.2
Red Hat Enterprise Linux Workstation (v. 6) spice-server-0.12.4-16.el6_10.2
Red Hat Enterprise Linux Workstation Optional (v. 6) spice-server-devel-0.12.4-16.el6_10.2

Fixes 1 record

TI-2017-05149 CVE-2017-7506 · GHSA-3pjw-h9v6-f5x8

Memory corruption in spice

MEDIUM 45

spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04204 Published 2017-07-18 Partial fix CWE-119