USN-3659-1 spice, spice-protocol vulnerability

Frediano Ziglio discovered that Spice incorrectly handled certain client messages. An attacker could possibly use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-3659-1: Spice vulnerability

Frediano Ziglio discovered that Spice incorrectly handled certain client messages. An attacker could possibly use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code...

The vulnerability of the SPICE client Spice-GTK, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the SPICE client Spice-gtk is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted server messages...

openSUSE Security Update : spice-gtk (openSUSE-2018-342)

This update for spice-gtk fixes the following issues : - CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with...

GLSA-201804-09 : SPICE VDAgent: Arbitrary command injection

The remote host is affected by the vulnerability described in GLSA-201804-09 SPICE VDAgent: Arbitrary command injection SPICE VDAgent does not properly escape save directory before passing to shell. Impact : A local attacker could execute arbitrary commands. Workaround : There is no known...

SPICE VDAgent: Arbitrary command injection

Background Provides a complete open source solution for remote access to virtual machines in a seamless way so you can play videos, record audio, share USB devices and share folders without complications. Description SPICE VDAgent does not properly escape save directory before passing to shell...

SUSE SLED12 / SLES12 Security Update : spice-gtk (SUSE-SU-2018:0877-1)

This update for spice-gtk fixes the following issues : - CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with...

SUSE-SU-2018:0877-1 Security update for spice-gtk

This update for spice-gtk fixes the following issues: - CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissio...

Red Hat spice-gtk integer overflow vulnerability

Red Hat SPICE is an enterprise virtualized desktop version of Red Hat's adaptive telepresence open-source protocol, which is used to connect users to their virtual desktops, providing the same end-user experience as a physical desktop. spice-client is its client program. A security vulnerability...

EulerOS 2.0 SP1 : spice-vdagent (EulerOS-SA-2018-1051)

According to the version of the spice-vdagent package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access...

EulerOS 2.0 SP2 : spice-vdagent (EulerOS-SA-2018-1052)

According to the version of the spice-vdagent package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access...

DEBIAN-CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

Design/Logic Flaw

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

CVE-2017-12194

CVE-2017-12194 affects spice-gtk up to version 0.34, where the spice-client component incorrectly processes certain messages from the server. The root cause is a flaw in how the client handles server-sent messages, which could allow an attacker-controlled spice-server to crash the client or execu...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client...

CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...