Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10893: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. 99999: CVE-2018-10893 spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | spice-glib | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-glib-devel | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-gtk-debuginfo | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-gtk-tools | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-gtk3 | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-gtk3-devel | 0:0.35-4.amzn2 |
| Amazon Linux · 2 | spice-gtk3-vala | 0:0.35-4.amzn2 |
Vulnerabilities 1
-
High 7.6
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-10893.html