Skip to content
OpenAdvisories
High ELSA-2016-1205 2 CVEs

Important: spice security update (Oracle Linux 7)

Published Jun 6, 2016 · Updated Jun 6, 2016

Ecosystem: Oracle Linux

Summary

[0.12.4-15.1]
- Fix heap-based memory corruption within smartcard handling
Resolves: CVE-2016-0749
- Fix host memory access from guest with invalid primary surface parameters
Resolves: CVE-2016-2150

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 spice-server 0:0.12.4-15.el7_2.1
Oracle Linux · 7 spice-server-devel 0:0.12.4-15.el7_2.1

Vulnerabilities 2

  • Unscored —
    CVE-2016-0749

    The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or pos…

    spice spice Debian Ubuntu
  • Unscored —
    CVE-2016-2150

    SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface …

    spice spice Debian Ubuntu