USN-2736-1

See a problem?

Source

https://ubuntu.com/security/notices/USN-2736-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2736-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-2736-1

Related

Published

2015-09-08T14:01:24.950117Z

Modified

2015-09-08T14:01:24.950117Z

Summary

spice vulnerability

Details

Frediano Ziglio discovered that Spice incorrectly handled monitor configs. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile.

References

Affected packages

Ubuntu:14.04:LTS / spice

Package

Name: spice
Purl: pkg:deb/ubuntu/spice?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.12.4-0nocelt2ubuntu1.1

Affected versions

0.*

0.12.4-0nocelt1

0.12.4-0nocelt1.1

0.12.4-0nocelt1.1ubuntu1

0.12.4-0nocelt2

0.12.4-0nocelt2ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "0.12.4-0nocelt2ubuntu1.1",
            "binary_name": "libspice-server-dev"
        },
        {
            "binary_version": "0.12.4-0nocelt2ubuntu1.1",
            "binary_name": "libspice-server1"
        },
        {
            "binary_version": "0.12.4-0nocelt2ubuntu1.1",
            "binary_name": "libspice-server1-dbgsym"
        },
        {
            "binary_version": "0.12.4-0nocelt2ubuntu1.1",
            "binary_name": "spice-client"
        },
        {
            "binary_version": "0.12.4-0nocelt2ubuntu1.1",
            "binary_name": "spice-client-dbgsym"
        }
    ]
}