CVE-2013-4130
Fixed in a distro release EPSS 3%
The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.
Products: spice_project spice, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | spice | 0.12.4-0nocelt1 |
| Debian 13 | spice | 0.12.4-0nocelt1 |
| Debian 14 | spice | 0.12.4-0nocelt1 |
| Debian 7 | spice | 0.11.0-1+deb7u1 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.4-20130912.1.el6_4 |
| Red Hat Enterprise Linux 6 | spice-server | 0:0.12.0-12.el6_4.3 |
| Red Hat Enterprise Linux 6 | spice-server-debuginfo | 0:0.12.0-12.el6_4.3 |
| Red Hat Enterprise Linux 6 | spice-server-devel | 0:0.12.0-12.el6_4.3 |
| Ubuntu 14.04 LTS | spice | 0.12.4-0nocelt1 |