Published: 07/06/2016 Updated: 16/09/2017

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.1 | Impact Score: 5.2 | Exploitability Score: 1.8

VMScore: 320

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N

Heap-based buffer overflow in SPICE prior to 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 15.04
canonical ubuntu linux 14.04
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux hpc node 6.0
redhat enterprise linux server eus 6.7.z
redhat enterprise linux workstation 6.0
redhat enterprise linux server eus 7.1
redhat enterprise linux hpc node eus 7.1
redhat enterprise linux hpc node 7.0
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
debian debian linux 7.0
debian debian linux 8.0
spice project spice

Spice could be made to crash or run programs ...

Debian Bug report logs - #801089 spice: CVE-2015-5260: Insufficient validation of surface_id parameter can cause crash Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Oct 2015 07:21:02 UTC Severity: grave Tags: patch, ...

Debian Bug report logs - #801091 spice: CVE-2015-5261: host memory access from guest using crafted images Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Oct 2015 07:24:06 UTC Severity: grave Tags: patch, security, up ...

A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation A user in a guest could use this flaw to read and write arbitrary memory locations on the host ...

CWE-119 http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html http://rhn.redhat.com/errata/RHSA-2015-1890.html http://www.debian.org/security/2015/dsa-3371 http://www.openwall.com/lists/oss-security/2015/10/06/4 https://bugzilla.redhat.com/show_bug.cgi?id=1261889 http://www.ubuntu.com/usn/USN-2766-1 http://rhn.redhat.com/errata/RHSA-2015-1889.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://security.gentoo.org/glsa/201606-05 http://www.securitytracker.com/id/1033753 https://usn.ubuntu.com/2766-1/https://nvd.nist.gov

CVE-2015-5261

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect