Description (CNA)
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://rhn.redhat.com/errata/RHSA-2015-1890.html
- http://www.openwall.com/lists/oss-security/2015/10/06/4
- https://security.gentoo.org/glsa/201606-05
- https://bugzilla.redhat.com/show_bug.cgi?id=1261889
- http://www.ubuntu.com/usn/USN-2766-1
- http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://rhn.redhat.com/errata/RHSA-2015-1889.html
- http://www.debian.org/security/2015/dsa-3371
- http://www.securitytracker.com/id/1033753
ADP enrichment
No English description supplied.
- http://rhn.redhat.com/errata/RHSA-2015-1890.html
- http://www.openwall.com/lists/oss-security/2015/10/06/4
- https://security.gentoo.org/glsa/201606-05
- https://bugzilla.redhat.com/show_bug.cgi?id=1261889
- http://www.ubuntu.com/usn/USN-2766-1
- http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://rhn.redhat.com/errata/RHSA-2015-1889.html
- http://www.debian.org/security/2015/dsa-3371
- http://www.securitytracker.com/id/1033753