Published: 07/06/2016 Updated: 13/02/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Heap-based buffer overflow in SPICE prior to 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux server eus 6.7.z
redhat enterprise linux hpc node 6.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 14.04
canonical ubuntu linux 15.04
spice project spice
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux server eus 7.1
redhat enterprise linux hpc node eus 7.1

Spice could be made to crash or run programs ...

Debian Bug report logs - #801089 spice: CVE-2015-5260: Insufficient validation of surface_id parameter can cause crash Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Oct 2015 07:21:02 UTC Severity: grave Tags: patch, ...

Debian Bug report logs - #801091 spice: CVE-2015-5261: host memory access from guest using crafted images Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Oct 2015 07:24:06 UTC Severity: grave Tags: patch, security, up ...

CWE-119 http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html http://rhn.redhat.com/errata/RHSA-2015-1890.html http://www.debian.org/security/2015/dsa-3371 http://www.ubuntu.com/usn/USN-2766-1 https://bugzilla.redhat.com/show_bug.cgi?id=1260822 http://rhn.redhat.com/errata/RHSA-2015-1889.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/77019 https://security.gentoo.org/glsa/201606-05 http://www.securitytracker.com/id/1033753 https://usn.ubuntu.com/2766-1/https://nvd.nist.gov

CVE-2015-5260

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect