Medium: libgovirt

Issue Overview:

Multiple integer overflow and buffer overflow issues were discovered in spice-client’s handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. (CVE-2018-10893)

Affected Packages:

libgovirt

Issue Correction:
Run yum update libgovirt to update your system.

New Packages:

aarch64:  
    libgovirt-0.3.4-3.amzn2.aarch64  
    libgovirt-devel-0.3.4-3.amzn2.aarch64  
    libgovirt-debuginfo-0.3.4-3.amzn2.aarch64  
  
i686:  
    libgovirt-0.3.4-3.amzn2.i686  
    libgovirt-devel-0.3.4-3.amzn2.i686  
    libgovirt-debuginfo-0.3.4-3.amzn2.i686  
  
src:  
    libgovirt-0.3.4-3.amzn2.src  
  
x86_64:  
    libgovirt-0.3.4-3.amzn2.x86_64  
    libgovirt-devel-0.3.4-3.amzn2.x86_64  
    libgovirt-debuginfo-0.3.4-3.amzn2.x86_64  

Additional References

Red Hat: CVE-2018-10893

Mitre: CVE-2018-10893