EUVD-2018-21869

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators...

RHSA-2017:0254 Red Hat Security Advisory: spice security update

Bulletin has no description...

RHSA-2019:0231 Red Hat Security Advisory: spice security update

Bulletin has no description...

RHSA-2015:1714 Red Hat Security Advisory: spice security update

Bulletin has no description...

SUSE-SU-2019:0241-1 Security update for spice

This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706...

DLA-1649-1 spice - security update

Bulletin has no description...

SUSE-SU-2017:1837-1 Security update for spice

This update for spice fixes the following issues: - CVE-2017-7506: A possible buffer overflow via invalid monitor configurations bsc1046779...

DSA-3790-1 spice - security update

Bulletin has no description...

CVE-2016-0749

The smartcard interaction in SPICE allows remote attackers to cause a denial of service QEMU-KVM process crash or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow...

SUSE-SU-2016:1259-1 Security update for spice

Spice was updated to fix three security issues. The following vulnerabilities were fixed: CVE-2015-3247: heap corruption in the spice server bsc944460 CVE-2015-5261: Guest could have accessed host memory using crafted images bsc948976 CVE-2015-5260: Insufficient validation of surfaceid parameter...

SUSE-SU-2015:0884-2 Security update for spice

The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service crash via a long password in a SPICE ticket. bsc848279, CVE-2013-4...

CVE-2013-4282

Stack-based buffer overflow in the redshandleticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service crash via a long password in a SPICE ticket...