VulnerableCode Package Details - pkg:deb/ubuntu/spice@0.12.4-0nocelt2ubuntu1.4

Search for packages

Vulnerability	Summary	Fixed by
VCID-afzs-1b88-aaaf Aliases: CVE-2018-10873	A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.	0.12.4-0nocelt2ubuntu1.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-q6fk-hm76-aaaf Aliases: CVE-2017-12194	A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.	0.12.4-0nocelt2ubuntu1.6 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-stbg-r14q-aaap Aliases: CVE-2017-7506	spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak.	0.12.4-0nocelt2ubuntu1.5 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-usmx-bw7t-aaan Aliases: CVE-2019-3813	Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.	0.12.4-0nocelt2ubuntu1.8 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-afzs-1b88-aaaf
Aliases:
CVE-2018-10873

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

0.12.4-0nocelt2ubuntu1.7
Affected by 1 other vulnerability.

VCID-q6fk-hm76-aaaf
Aliases:
CVE-2017-12194

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.

0.12.4-0nocelt2ubuntu1.6
Affected by 2 other vulnerabilities.

VCID-stbg-r14q-aaap
Aliases:
CVE-2017-7506

spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak.

0.12.4-0nocelt2ubuntu1.5
Affected by 3 other vulnerabilities.

VCID-usmx-bw7t-aaan
Aliases:
CVE-2019-3813

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.

0.12.4-0nocelt2ubuntu1.8
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-c72y-q8u3-aaaj	A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.	CVE-2016-9577
VCID-kn3r-w5hz-aaaj	A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.	CVE-2016-9578

Vulnerability

Summary

Aliases

VCID-c72y-q8u3-aaaj

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.

CVE-2016-9577

VCID-kn3r-w5hz-aaaj

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

CVE-2016-9578

Next non-vulnerable version	0.12.4-0nocelt2ubuntu1.8
Latest non-vulnerable version	0.12.4-0nocelt2ubuntu1.8
Risk	4.5