NetSight
IP …
high8.3

CVE-2018-10873

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks.

Impact

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Affected products

VendorProductAffected versions
Spice ProjectSpice
before 0.14.1
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04
RedhatVirtualization
Version 4.0
RedhatVirtualization Host
Version 4.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Version 7.6
RedhatEnterprise Linux Server Eus
Versions 7.5, 7.6
RedhatEnterprise Linux Server Tus
Version 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-119CWE-20

References