18 results · Feed
-
High 7.5
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap mem…
-
High 7.5
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer ove…
-
Unscored —
An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a securi…
-
Unscored —
A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a d…
-
Unscored —
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syst…
-
Unscored —
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get…
-
High 8.3
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages …
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect t…
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker cou…
-
Unscored —
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control o…
-
Unscored —
spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages fro…
-
Unscored —
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or pos…
-
Unscored —
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface …
-
Unscored —
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory…
-
Unscored —
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations…
-
Unscored —
Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user t…
-
Unscored —
Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers…
-
Unscored —
The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE b…