CVSS: 10.0EPSS: 20%CPEs: 19EXPL: 0CVE-2016-0749 – spice: heap-based memory corruption within smartcard handling
https://notcve.org/view.php?id=CVE-2016-0749
07 Jun 2016 — The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow. La interacción smartcard en SPICE permite a atacantes remotos provocar un denegación de servicio (caída del proceso QEMU-KVM) o ejecutar, posiblemente, un código arbitrario a través de véctores relacionados con conectarse con un invitado VM, lo que ejecuta un desbordami... • http://lists.opensuse.org/opensuse-updates/2016-07/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.1EPSS: 0%CPEs: 19EXPL: 0CVE-2016-2150 – spice: Host memory access from guest with invalid primary surface parameters
https://notcve.org/view.php?id=CVE-2016-2150
07 Jun 2016 — SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261. SPICE permite a usuarios invitados locales del sistema operativo leer de o escribir a localizaciones de memoria de acogidas arbitrarias a través de parámetros de superficie primaria manipulados, un problema similar a CVE-2015-5261. A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A ... • http://lists.opensuse.org/opensuse-updates/2016-07/msg00003.html • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 0CVE-2015-5260 – spice: insufficient validation of surface_id parameter can cause crash
https://notcve.org/view.php?id=CVE-2015-5260
07 Oct 2015 — Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter. Desbordamiento de buffer basado en memoria dinámica en SPICE en versiones anteriores a 0.12.6 permite a usuarios invitados del SO provocar una denegación de servicio (corrupción basada en memoria dinámica y caída de QEMu-KVM) o posiblemente ejecutar código arb... • http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.1EPSS: 0%CPEs: 16EXPL: 0CVE-2015-5261 – spice: host memory access from guest using crafted images
https://notcve.org/view.php?id=CVE-2015-5261
07 Oct 2015 — Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation. Desbordamiento de buffer basado en memoria dinámica en SPICE en versiones anteriores a 0.12.6 permite a usuarios invitados del SO leer y escribir en localizaciones de memoria arbitrarias en el anfitrión a través de comandos QXL de invitado relacionados con la creación de superficie. A heap-based buffer overflow flaw was found ... • http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2015-3247 – spice: memory corruption in worker_update_monitors_config()
https://notcve.org/view.php?id=CVE-2015-3247
03 Sep 2015 — Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors. Vulnerabilidad de condición de carrera en la función worker_update_monitors_config en SPICE 0.12.4, permite a usuarios remotos autenticados invitados causar una denegación de servicio (corrupción de memoria dinámica y caída de QEMU-KVM) o posi... • http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 1CVE-2013-4282 – spice: stack buffer overflow in reds_handle_ticket() function
https://notcve.org/view.php?id=CVE-2013-4282
29 Oct 2013 — Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. Desbordamiento de búfer de pila en la función reds_handle_ticket en server/reds.c en SPICE 0.12.0 que permite a atacantes remotos provocar una denegación de servicio (caída) a través de una contraseña larga en un ticket de SPICE. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor I... • http://cgit.freedesktop.org/spice/spice/commit/?id=8af619009660b24e0b41ad26b30289eea288fcc2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-4324 – spice-gtk: Insecure calling of polkit via polkit_unix_process_new()
https://notcve.org/view.php?id=CVE-2013-4324
20 Sep 2013 — spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288. spice-gtk 0.14, y posiblemente otras versiones, invoca la autoridad polkit utilizando la función insegura polkit_unix_process_new API, que permite a usuarios locales eludir... • http://lists.opensuse.org/opensuse-updates/2013-10/msg00031.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 25EXPL: 0CVE-2013-4130 – spice: unsafe clients ring access abort
https://notcve.org/view.php?id=CVE-2013-4130
14 Aug 2013 — The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error. Las funciones (1) red_channel_pipes_add_type y (2) red_channel_pipes_add_empty_msg ein server/red_channel.c en SPICE before 0.12.4, no realizan bucles en anillo adecuadamente, lo que podría permitir a atacantes ... • http://cgit.freedesktop.org/spice/spice/commit/?id=53488f0275d6c8a121af49f7ac817d09ce68090d • CWE-399: Resource Management Errors •