Important: spice

Issue Overview: Spice, versions 0.5.2 through 0.14.0, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.CVE-2019-3813 Affected Packages: spice Note: This...

The vulnerability of the memslot_get_virt function in the rendering system for deleted virtual workstations in SPICE allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the memslotgetvirt function in the SPICE rendering system’s “deleted virtual working area” component is related to the possibility of reading values beyond the allowed range due to an off-by-one error. Exploiting this vulnerability can allow a remote attacker to cause service...

Security fix for the ALT Linux 8 package SPICE version 0.14.1-alt1

0.14.1-alt1 built March 11, 2019 Andrey Cherepanov in task 217681 Aug. 31, 2018 Alexey Shabalin - 0.14.1 Fixes: CVE-2018-10873...

EulerOS 2.0 SP5 : spice (EulerOS-SA-2019-1075)

According to the version of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - spice: Off-by-one error in array access in spice/server/memslot.c CVE-2019-3813 Note that Tenable Network Security has extracted the preceding...

spice: Off-by-one error in array access in spice/server/memslot.c

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers...

Security Bulletin: A vulnerability in Spice affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Spice. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2019-3813 DESCRIPTION: Spice is vulnerable to a denial of service, caused by an off-by-one error in array access in spice/server/memslot.c. A local attacker could...

Fedora 28 : spice (2019-afade40f3d)

Fixes CVE-2019-3813 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, In...

[SECURITY] Fedora 28 Update: spice-0.14.0-5.fc28

The Simple Protocol for Independent Computing Environments SPICE is a remote display system built for virtual environments which allows you to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine...

Fedora Update for spice FEDORA-2019-afade40f3d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Updated spice-gtk packages fix security vulnerability

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

MGASA-2019-0099 Updated spice-gtk packages fix security vulnerability

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are...

MGASA-2019-0100 Updated spice packages fix security vulnerability

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. CVE-2019-3813 A vulnerability was discovered in SPICE before versio...

Updated spice packages fix security vulnerability

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. CVE-2019-3813 A vulnerability was discovered in SPICE before versio...

openSUSE: Security Advisory for spice (openSUSE-SU-2019:0176-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : spice (openSUSE-2019-176)

This update for spice fixes the following issues : Security issue fixed : - CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706. This update was imported from the SUSE:SLE-12-SP3:Update update project...

openSUSE Security Update : spice (openSUSE-2019-167)

This update for spice fixes the following issues : Security issue fixed : - CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706. Non-security issue fixed : - Include spice-server tweak to compensate for...

Security update for spice (important)

openSUSE Security Update: Security update for spice Announcement ID: openSUSE-SU-2019:0176-1 Rating: important References: 1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 42.3 An update that fixes one vulnerability is now available. Description: This update for spice fixe...

openSUSE: Security Advisory for spice (openSUSE-SU-2019:0167-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for spice (important)

openSUSE Security Update: Security update for spice Announcement ID: openSUSE-SU-2019:0167-1 Rating: important References: 1109044 1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has one errata is now available. Description...

Fedora 29 : spice (2019-a095a16c47)

Fixes CVE-2019-3813 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, In...