CVE-2016-0749
Fixed in a distro release EPSS 8%
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
Products: opensuse leap, opensuse, debian_linux, redhat enterprise_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation, redhat enterprise_linux_hpc_node_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, spice_project spice
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | spice | 0.12.6-4.1 |
| Debian 13 | spice | 0.12.6-4.1 |
| Debian 14 | spice | 0.12.6-4.1 |
| Debian 8 | spice | 0.12.5-1+deb8u3 |
| Red Hat Enterprise Linux 6 | spice-server | 0:0.12.4-13.el6.1 |
| Red Hat Enterprise Linux 6 | spice-server-debuginfo | 0:0.12.4-13.el6.1 |
| Red Hat Enterprise Linux 6 | spice-server-devel | 0:0.12.4-13.el6.1 |
| Red Hat Enterprise Linux 7 | spice | 0:0.12.4-15.el7_2.1 |
| Red Hat Enterprise Linux 7 | spice-debuginfo | 0:0.12.4-15.el7_2.1 |
| Red Hat Enterprise Linux 7 | spice-server | 0:0.12.4-15.el7_2.1 |
| Red Hat Enterprise Linux 7 | spice-server-devel | 0:0.12.4-15.el7_2.1 |
| SUSE Linux Enterprise Desktop 12 | spice | 0.12.4-8.9.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Server 12 | spice | 0.12.4-8.9.1 |
| SUSE Linux Enterprise Server 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | spice | 0.12.4-8.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | spice | 0.12.5-4.1 |
| SUSE Linux Enterprise Software Development Kit 12 | spice | 0.12.4-8.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | spice | 0.12.5-4.1 |
| Ubuntu 14.04 LTS | spice | 0.12.4-0nocelt2ubuntu1.3 |
| Ubuntu 16.04 LTS | spice | 0.12.6-4ubuntu0.1 |
| openSUSE Tumbleweed | spice | 0.12.8-2.1 |