Denial Of Service (DoS)

2019-01-1509:07:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

JSON

spice-server is vulnerable to denial of service (DoS) attacks. The vulnerability exists through a race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.

CPENameOperatorVersion
spice-servereq0.8.0__1.el6
spice-servereq0.12.0__12.el6_4.1
spice-servereq0.4.2__15.el6
spice-servereq0.12.0__12.el6_4.5
spice-servereq0.12.4__6.el6
spice-servereq0.12.4__11.el6
spice-servereq0.10.1__10.el6
spice-servereq0.12.4__6.el6_5.1
spice-servereq0.8.2__5.el6
spice-servereq0.12.0__12.el6_4.2

Name	Operator	Version
spice-server	eq	0.8.0__1.el6
spice-server	eq	0.12.0__12.el6_4.1
spice-server	eq	0.4.2__15.el6
spice-server	eq	0.12.0__12.el6_4.5
spice-server	eq	0.12.4__6.el6
spice-server	eq	0.12.4__11.el6
spice-server	eq	0.10.1__10.el6
spice-server	eq	0.12.4__6.el6_5.1
spice-server	eq	0.8.2__5.el6
spice-server	eq	0.12.0__12.el6_4.2