spice-gtk: Insecure calling of polkit via polkit_unix_process_new()

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...

spice-gtk security update

0.14-7.3 - New build with correct patch for CVE-2013-4324 0.14-7.2 - Fix race condition in policykit use CVE-2013-4324 Resolves: CVE-2013-4324...

RedHat Update for spice-server RHSA-2013:1192-01

Check for the Version of spice-server OpenVAS Vulnerability Test RedHat Update for spice-server RHSA-2013:1192-01 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for spice-server CESA-2013:1192 centos6

Check for the Version of spice-server OpenVAS Vulnerability Test CentOS Update for spice-server CESA-2013:1192 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify...

RedHat Update for spice-server RHSA-2013:1192-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for spice-server CESA-2013:1192 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : spice-server on SL6.x x86_64 (20130903)

A flaw was found in the way concurrent access to the clients ring buffer was performed in the spice-server library. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application. CVE-2013-4130 Applications acting as a SPI...

CentOS 6 : spice-server (CESA-2013:1192)

An updated spice-server package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

RHEL 6 : spice-server (RHSA-2013:1192)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1192 advisory. The Simple Protocol for Independent Computing Environments SPICE is a remote display protocol for virtual environments. SPICE users can access a...

Oracle Linux 6 : spice-server (ELSA-2013-1192)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1192 advisory. 0.12.0-12.el64.3 - Fixes an abort on unsafe client ring access Resolves: rhbz986298 Tenable has extracted the preceding description block directly from the Orac...

spice security update

CentOS Errata and Security Advisory CESA-2013:1192 An updated spice-server package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS...

spice: unsafe clients ring access abort

The 1 redchannelpipesaddtype and 2 redchannelpipesaddemptymsg functions in server/redchannel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service reachable assertion and server exit by triggering a network error...

Moderate: Red Hat Security Advisory: spice-server security update

An updated spice-server package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

spice-server security update

0.12.0-12.el64.3 - Fixes an abort on unsafe client ring access Resolves: rhbz986298...

SPICE DoS

assert on loops processing...

[ MDVSA-2013:217 ] spice

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:217 http://www.mandriva.com/en/support/security/ Package : spice Date : August 23, 2013 Affected: Business Server 1.0 Problem Description: Updated spice packages fix security vulnerability: An user able to...

Mandriva Linux Security Advisory : spice (MDVSA-2013:217)

Updated spice packages fix security vulnerability : An user able to initiate spice connection to the guest could use a flaw in server/redchannel.c to crash the guest CVE-2013-4130. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

MGASA-2013-0255 Updated spice packages fix CVE-2013-4130

Updated spice packages fix security vulnerability: An user able to initiate spice connection to the guest could use a flaw in server/redchannel.c to crash the guest CVE-2013-4130...

Updated spice packages fix CVE-2013-4130

Updated spice packages fix security vulnerability: An user able to initiate spice connection to the guest could use a flaw in server/redchannel.c to crash the guest CVE-2013-4130...

DEBIAN-CVE-2013-4130

The 1 redchannelpipesaddtype and 2 redchannelpipesaddemptymsg functions in server/redchannel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service reachable assertion and server exit by triggering a network error...