Denial Of Service (DoS)

2019-01-1509:01:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

qspice is vulnerable to denial of service (DoS) attacks. The vulnerability exists through a stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

CPENameOperatorVersion
qspiceeq0.3.0__39.el5
qspiceeq0.3.0__54.el5_5.1
qspiceeq0.3.0__39.el5_4.3
qspiceeq0.3.0__54.el5
qspiceeq0.3.0__54.el5_5.2
spice-servereq0.8.2__5.el6
spice-servereq0.4.2__15.el6
spice-servereq0.8.0__1.el6
spice-servereq0.10.1__10.el6
qspiceeq0.3.0__39.el5

Name	Operator	Version
qspice	eq	0.3.0__39.el5
qspice	eq	0.3.0__54.el5_5.1
qspice	eq	0.3.0__39.el5_4.3
qspice	eq	0.3.0__54.el5
qspice	eq	0.3.0__54.el5_5.2
spice-server	eq	0.8.2__5.el6
spice-server	eq	0.4.2__15.el6
spice-server	eq	0.8.0__1.el6
spice-server	eq	0.10.1__10.el6
qspice	eq	0.3.0__39.el5