SUSE-SU-2021:2614-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2021:2614-1

Related

Published

2021-08-05T08:19:23Z

Modified

2021-08-05T08:19:23Z

Summary

Security update for spice-vdagent

Details

This update for spice-vdagent fixes the following issues:

Update to version 0.21.0
CVE-2020-25650: memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780)
CVE-2020-25651: possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781)
CVE-2020-25652: possibility to exhaust file descriptors in vdagentd (bsc#1177782)
CVE-2020-25653: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (bsc#1177783)

References

Affected packages

Name: spice-vdagent
Purl: pkg:rpm/suse/spice-vdagent&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.21.0-3.3.1

{
    "binaries": [
        {
            "spice-vdagent": "0.21.0-3.3.1"
        }
    ]
}