Denial Of Service (DoS)

libspice.so is vulnerable to denial of service. The vulnerability is possible because the function memslotgetvirt lacks the proper boundary checking for slotid array in memslot.c, which is calculated using a QXLPHYSICAL address set by the guest QXL driver, thereby allowing an attacker to input...