Published: 09/06/2016 Updated: 22/04/2019

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.1 | Impact Score: 5.2 | Exploitability Score: 1.8

VMScore: 320

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise_linux_server 7.0
redhat enterprise_linux 7.0
redhat enterprise_linux_server_eus 7.2
redhat enterprise_linux_server_aus 7.2
redhat enterprise_linux_workstation 7.0
redhat enterprise_linux_hpc_node_eus 7.2
redhat enterprise_linux_desktop 7.0
opensuse opensuse 13.2
opensuse leap 42.1
debian debian linux 8.0
redhat enterprise_linux 6.0
redhat enterprise_linux_workstation 6.0
redhat enterprise_linux_server 6.0
redhat enterprise_linux_desktop 6.0
spice project spice -

Several security issues were fixed in Spice ...

Debian Bug report logs - #826585 spice: CVE-2016-0749: heap-based memory corruption within smartcard handling Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 6 Jun 2016 17:18:17 UTC Severity: grave Tags: patch, security ...

Debian Bug report logs - #826584 spice: CVE-2016-2150: Host memory access from guest with invalid primary surface parameters Package: src:spice; Maintainer for src:spice is Liang Guo <guoliang@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 6 Jun 2016 17:18:11 UTC Severity: grave Tags: ...

A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host ...

CWE-284 https://bugzilla.redhat.com/show_bug.cgi?id=1313496 http://www.debian.org/security/2016/dsa-3596 https://access.redhat.com/errata/RHSA-2016:1205 https://access.redhat.com/errata/RHSA-2016:1204 http://lists.opensuse.org/opensuse-updates/2016-07/msg00003.html http://lists.opensuse.org/opensuse-updates/2016-07/msg00004.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.ubuntu.com/usn/USN-3014-1 https://security.gentoo.org/glsa/201606-05 https://usn.ubuntu.com/3014-1/https://nvd.nist.gov

CVE-2016-2150

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect