CVE-2015-5260
Fixed in a distro release EPSS <1%
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.
Products: redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation, debian_linux, canonical ubuntu_linux, spice_project spice, redhat enterprise_linux_hpc_node_eus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | spice | 0.12.5-1.3 |
| Debian 13 | spice | 0.12.5-1.3 |
| Debian 14 | spice | 0.12.5-1.3 |
| Debian 7 | spice | 0.11.0-1+deb7u2 |
| Debian 8 | spice | 0.12.5-1+deb8u2 |
| Red Hat Enterprise Linux 6 | spice-server | 0:0.12.4-12.el6_7.3 |
| Red Hat Enterprise Linux 6 | spice-server-debuginfo | 0:0.12.4-12.el6_7.3 |
| Red Hat Enterprise Linux 6 | spice-server-devel | 0:0.12.4-12.el6_7.3 |
| Red Hat Enterprise Linux 7 | spice | 0:0.12.4-9.el7_1.3 |
| Red Hat Enterprise Linux 7 | spice-debuginfo | 0:0.12.4-9.el7_1.3 |
| Red Hat Enterprise Linux 7 | spice-server | 0:0.12.4-9.el7_1.3 |
| Red Hat Enterprise Linux 7 | spice-server-devel | 0:0.12.4-9.el7_1.3 |
| SUSE Linux Enterprise Desktop 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Server 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Server 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Server 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | spice | 0.12.4-5.1 |
| SUSE Linux Enterprise Software Development Kit 12 | spice | 0.12.4-8.5.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | spice | 0.12.5-4.1 |
| Ubuntu 14.04 LTS | spice | 0.12.4-0nocelt2ubuntu1.2 |
| Ubuntu 16.04 LTS | spice | 0.12.5-1.1ubuntu2 |
| openSUSE Tumbleweed | spice | 0.12.8-2.1 |