(RHSA-2013:0924) Important: spice-vdagent-win security and bug fix update

spice-vdagent-win provides a service and an agent that can be installed and
run on Windows guests.

An unquoted search path flaw was found in the way the SPICE service was
installed on Windows. Depending on the permissions of the directories in
the unquoted search path, a local, unprivileged user could use this flaw to
have a binary of their choosing executed with SYSTEM privileges.
(CVE-2013-2152)

This update also fixes the following bugs:

• Previously, due to issues with some Windows guest applications, RHEV
  SPICE agent stopped getting clipboard changes. Now, the agent uses a new
  API that keeps track of clipboard changes, without the need to “trust” the
  behavior of other applications registered to the clipboard. (BZ#919451)

• Previously, copying a .jpg or .png image file from specific applications,
  such as Mozilla Firefox, on a Windows guest, then pasting into a Linux
  client, resulted in an empty or black and white image due to incorrect
  pallete encoding in the guest vdagent. Now, the encoding has been fixed and
  copying and pasting works as expected. (BZ#919150)

• Previously, when using a Windows virtual machine, enabling extra monitors
  with arbitrary configuration could fail. Now the agent enables the monitors
  before updating it to an arbitrary resolution to solve this issue.
  (BZ#922394)

• Previously, if SPICE was disconnected in the middle of copying and
  pasting data from the client to the guest, copy and paste would stop
  working after SPICE was reconnected. Now, the clipboard timeout has been
  adjusted so that if SPICE is unexpectedly disconnected, the immediate copy
  and paste action will fail, but subsequent attempts will be successful.
  (BZ#833835)

• Previously, when attempting to connect multiple displays using a Windows
  7 guest, remote-viewer would only show one display available, even when all
  settings in the manager and on the SPICE client itself were correctly
  configured. This was caused by a regression issue relating to changes to
  custom resolution commands. Now, connecting and displaying multiple
  monitors functions correctly. (BZ#922283)

• Previously, due to a regression caused by another patch, copying a .png
  image from specific applications, such as Firefox, on a Linux client,
  failed pasting into a Windows guest application, such as Paint, due to
  incorrect pallete encoding in the guest vdagent. Now, the encoding has been
  fixed and copying and pasting works as expected. (BZ#921980)

• Previously, when a second user logged into a Windows guest, the RHEV
  SPICE Agent service terminated the previous vdagent instance, but
  mistakenly also the newly created vdagent on the current active session.
  Now, the vdagent termination event is reset after previous agent
  termination, so each new agent is no longer terminated. (BZ#868254)

• Previously, if “RHEV SPICE agent” was stopped after copying data from a
  Windows guest, the client was not correctly notified, and assumed it could
  still paste the data. Now, agent termination has been fixed so that the
  client is notified to release the clipboard. (BZ#903379)