[SECURITY] [DLA 541-1] libvirt security update

Package : libvirt Version : 0.9.12.3-1+deb7u2 CVE ID : CVE-2016-5008 It was discovered that there was a password policy issue in libvirt, a library for interfacing with different virtualization systems. Setting an empty graphics password is documented as a way to disable VNC/SPICE access, but QEM...

Debian DLA-531-1 : spice security update

A vulnerability has been found in the Simple Protocol for Independent Computing Environments, SPICE. Frediano Ziglio from Red Hat discovered that SPICE allowed local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters. For Debian 7...

[SECURITY] [DLA 531-1] spice security update

Package : spice Version : 0.11.0-1+deb7u3 CVE ID : CVE-2016-2150 Debian Bug : 826584 A vulnerability has been found in the Simple Protocol for Independent Computing Environments, SPICE. Frediano Ziglio from Red Hat discovered that SPICE allowed local guest OS users to read from or write to...

DLA-531-1 spice - security update

Bulletin has no description...

Ubuntu: Security Advisory (USN-3014-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : Spice vulnerabilities (USN-3014-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3014-1 advisory. Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to...

USN-3014-1 spice vulnerabilities

Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. CVE-2016-0749...

USN-3014-1: Spice vulnerabilities

Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. CVE-2016-0749...

SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1561-1)

spice was updated to fix two security issues. These security issues were fixed : - CVE-2016-2150: Guest escape using crafted primary surface parameters bsc982386. - CVE-2016-0749: Heap-based buffer overflow in smartcard interaction bsc982385. Note that Tenable Network Security has extracted the...

Scientific Linux Security Update : spice-server on SL6.x x86_64 (20160606)

Security Fixes : - A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute...

SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1559-1)

spice was updated to fix four security issues. These security issues were fixed : - CVE-2016-2150: Guest escape using crafted primary surface parameters bsc982386. - CVE-2016-0749: Heap-based buffer overflow in smartcard interaction bsc982385. - CVE-2015-5260: Insufficient validation of surfaceid...

GLSA-201606-05 : spice: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201606-05 spice: Multiple vulnerabilities Multiple vulnerabilities have been discovered in spice, please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code...

spice: Multiple vulnerabilities

Background Provides a complete open source solution for remote access to virtual machines in a seamless way so you can play videos, record audio, share usb devices and share folders without complications. Description Multiple vulnerabilities have been discovered in spice, please review the CVE...

SUSE-SU-2016:1561-1 Security update for spice

spice was updated to fix two security issues. These security issues were fixed: - CVE-2016-2150: Guest escape using crafted primary surface parameters bsc982386. - CVE-2016-0749: Heap-based buffer overflow in smartcard interaction bsc982385...

SUSE-SU-2016:1559-1 Security update for spice

spice was updated to fix four security issues. These security issues were fixed: - CVE-2016-2150: Guest escape using crafted primary surface parameters bsc982386. - CVE-2016-0749: Heap-based buffer overflow in smartcard interaction bsc982385. - CVE-2015-5260: Insufficient validation of surfaceid...

CVE-2016-2150

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261...

CVE-2016-2150

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261...

DEBIAN-CVE-2016-2150

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261...

DEBIAN-CVE-2016-0749

The smartcard interaction in SPICE allows remote attackers to cause a denial of service QEMU-KVM process crash or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow...

CVE-2016-0749

The smartcard interaction in SPICE allows remote attackers to cause a denial of service QEMU-KVM process crash or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow...