Skip to content
OpenAdvisories
Unscored USN-2766-1 2 CVEs

spice vulnerabilities

Published Oct 7, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Frediano Ziglio discovered multiple buffer overflows, undefined behavior
signed integer operations, race conditions, memory leaks, and denial
of service issues in Spice. A malicious guest operating system could
potentially exploit these issues to escape virtualization. (CVE-2015-5260,
CVE-2015-5261)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS spice 0.12.4-0nocelt2ubuntu1.2

Vulnerabilities 2

  • Unscored —
    CVE-2015-5260

    Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory…

    spice spice Debian Ubuntu
  • Unscored —
    CVE-2015-5261

    Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations…

    spice spice Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-5260
  • report
    https://ubuntu.com/security/CVE-2015-5261