CVE-2015-3247
Fixed in a distro release EPSS 1%
Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.
Products: spice_project spice, redhat enterprise_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | spice | 0.12.5-1.2 |
| Debian 13 | spice | 0.12.5-1.2 |
| Debian 14 | spice | 0.12.5-1.2 |
| Debian 8 | spice | 0.12.5-1+deb8u1 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.7-20150828.0.el6ev |
| Red Hat Enterprise Linux 6 | rhev-hypervisor7 | 0:7.1-20150827.1.el6ev |
| Red Hat Enterprise Linux 6 | spice-server | 0:0.12.4-12.el6_7.1 |
| Red Hat Enterprise Linux 6 | spice-server-debuginfo | 0:0.12.4-12.el6_7.1 |
| Red Hat Enterprise Linux 6 | spice-server-devel | 0:0.12.4-12.el6_7.1 |
| Red Hat Enterprise Linux 7 | rhev-hypervisor7 | 0:7.1-20150827.1.el7ev |
| Red Hat Enterprise Linux 7 | spice | 0:0.12.4-9.el7_1.1 |
| Red Hat Enterprise Linux 7 | spice-debuginfo | 0:0.12.4-9.el7_1.1 |
| Red Hat Enterprise Linux 7 | spice-server | 0:0.12.4-9.el7_1.1 |
| Red Hat Enterprise Linux 7 | spice-server-devel | 0:0.12.4-9.el7_1.1 |
| SUSE Linux Enterprise Desktop 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Server 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Server 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Software Development Kit 12 | spice | 0.12.4-8.5.1 |
| Ubuntu 14.04 LTS | spice | 0.12.4-0nocelt2ubuntu1.1 |
| openSUSE Tumbleweed | spice | 0.12.8-2.1 |