Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-105959: A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data. CVE-2026-105958: A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | spice-debuginfo | 0:0.14.0-10.amzn2 |
| Amazon Linux · 2 | spice-server | 0:0.14.0-10.amzn2 |
| Amazon Linux · 2 | spice-server-devel | 0:0.14.0-10.amzn2 |
Vulnerabilities 2
-
High 7.5
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap mem…
-
High 7.5
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer ove…