UbuntuUSN-2736-1Spice vulnerability
6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
8 High
AI Score
Confidence
High
0.009 Low
EPSS
Percentile
82.8%
Releases
- Ubuntu 15.04
- Ubuntu 14.04 ESM
Packages
- spice - SPICE protocol client and server library
Details
Frediano Ziglio discovered that Spice incorrectly handled monitor configs.
A malicious guest could use this issue to cause a denial of service, or
possibly execute arbitrary code on the host as the user running the QEMU
process. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 15.04 | noarch | libspice-server1 | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | libspice-server-dev | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | libspice-server-dev-dbgsym | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | libspice-server1-dbg | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | libspice-server1-dbgsym | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | spice-client | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 15.04 | noarch | spice-client-dbgsym | < 0.12.5-1ubuntu0.1 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libspice-server1 | < 0.12.4-0nocelt2ubuntu1.1 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libspice-server-dev | < 0.12.4-0nocelt2ubuntu1.1 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libspice-server1-dbgsym | < 0.12.4-0nocelt2ubuntu1.1 | UNKNOWN |
References
Related
6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
8 High
AI Score
Confidence
High
0.009 Low
EPSS
Percentile
82.8%