Published: 08/09/2015 Updated: 12/02/2023

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
spice project spice 0.12.4
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux 7.0
redhat enterprise linux 6.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux hpc node 6

Debian Bug report logs - #797976 spice: CVE-2015-3247: memory corruption in worker_update_monitors_config() Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 4 Sep 2015 06:24:02 UTC Severity: grave Tags: patch, security, ...

Spice could be made to crash or run programs ...

Frediano Ziglio of Red Hat discovered a race condition flaw in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption A malicious user in a guest can take advantage of this flaw to cause a denial of service (QEMU process crash) or, potentially execute arbitrary code on the host with the privileges of the hostin ...

CWE-119 CWE-362 http://rhn.redhat.com/errata/RHSA-2015-1714.html http://rhn.redhat.com/errata/RHSA-2015-1715.html http://www.securitytracker.com/id/1033459 http://rhn.redhat.com/errata/RHSA-2015-1713.html http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html http://www.ubuntu.com/usn/USN-2736-1 http://www.securitytracker.com/id/1033460 http://www.debian.org/security/2015/dsa-3354 http://lists.opensuse.org/opensuse-updates/2015-09/msg00018.html http://www.securitytracker.com/id/1033753 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797976 https://usn.ubuntu.com/2736-1/https://nvd.nist.gov

CVE-2015-3247

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect