Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3813: Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. 1665371: CVE-2019-3813 spice: Off-by-one error in array access in spice/server/memslot.c
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | spice-debuginfo | 0:0.14.0-6.amzn2.1 |
| Amazon Linux · 2 | spice-server | 0:0.14.0-6.amzn2.1 |
| Amazon Linux · 2 | spice-server-devel | 0:0.14.0-6.amzn2.1 |
Vulnerabilities 1
-
Unscored —
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3813.html