Read the docs
TI-2016-07799 Aliases CVE-2016-9577GHSA-fjp3-q3m4-wmjx

Heap-based buffer overflow in Red Hat spice

Priority MEDIUM 45CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.

Why it matters now

EPSS 0.03795 90th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 18 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatspice0.13.90—No fix listedCNA
  • spice VendorRed Hat Affected 0.13.90 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*before 0.13.90VulnerableThe SPICE Project
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
  • cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:* Versions before 0.13.90 Vulnerable ·The SPICE Project
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2017:0549 Released 2017-03-16 · Red Hat rating Moderate
    redhat-virtualization-host security and bug fix update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-0.8.16-0.1.el7ev, redhat-release-virtualization-host-4.0-7.1.el7, redhat-virtualization-host-image-update-placeholder-4.0-7.1.el7
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.0-20170307.1.el7_3, redhat-virtualization-host-image-update-4.0-20170307.1.el7_3
  • RHSA-2017:0552 Released 2017-03-16 · Red Hat rating Moderate
    rhevm-appliance security and bug fix update
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhevm-appliance-1:4.0.20170307.0-1.el7ev
  • RHSA-2017:0253 Released 2017-02-06 · Red Hat rating Moderate
    spice-server security update
    • Red Hat Enterprise Linux Desktop (v. 6) spice-server-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux Desktop Optional (v. 6) spice-server-devel-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux HPC Node (v. 6) spice-server-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) spice-server-devel-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux Server (v. 6) spice-server-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux Server Optional (v. 6) spice-server-devel-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux Workstation (v. 6) spice-server-0.12.4-13.el6_8.2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) spice-server-devel-0.12.4-13.el6_8.2
Show 1 more Red Hat advisories
  • RHSA-2017:0254 Released 2017-02-06 · Red Hat rating Moderate
    spice security update
    • Red Hat Enterprise Linux Client (v. 7) spice-0.12.4-20.el7_3, spice-server-0.12.4-20.el7_3
    • Red Hat Enterprise Linux Client Optional (v. 7) spice-server-devel-0.12.4-20.el7_3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) spice-0.12.4-20.el7_3, spice-server-0.12.4-20.el7_3, spice-server-devel-0.12.4-20.el7_3
    • Red Hat Enterprise Linux Server (v. 7) spice-0.12.4-20.el7_3, spice-server-0.12.4-20.el7_3
    • Red Hat Enterprise Linux Server Optional (v. 7) spice-server-devel-0.12.4-20.el7_3
    • Red Hat Enterprise Linux Workstation (v. 7) spice-0.12.4-20.el7_3, spice-server-0.12.4-20.el7_3
    • Red Hat Enterprise Linux Workstation Optional (v. 7) spice-server-devel-0.12.4-20.el7_3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat spice — RHSA-2017:0253

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07800 Improper input validation in Red Hat spicePriority LOW 38
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat spice — RHSA-2017:0549

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07800 Improper input validation in Red Hat spicePriority LOW 38
    Show all 2 records → Advisory →
Show 3 more groups
  • Advisory ·

    Red Hat spice — RHSA-2017:0254

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07800 Improper input validation in Red Hat spicePriority LOW 38
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat spice — RHSA-2017:0552

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07800 Improper input validation in Red Hat spicePriority LOW 38
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat spice — DSA-3790

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07800 Improper input validation in Red Hat spicePriority LOW 38
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Virtualization 4AffectedNo fix yet
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2017:0549
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:0254
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2017:0253
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2017:0254
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2017:0549
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2017:0552

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9577
  2. 2026-10-03 Alias added: GHSA-fjp3-q3m4-wmjx
  3. 2026-11-03 EPSS moved to the 90th–95th percentile

References

Advisory 6

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1927 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences