Description
Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | qspice-client | 0.3.0-4.el5_5 | RHSA-2010:0632 |
| RHEL 5 | spice-xpi | 2.2-2.3.el5_5 | RHSA-2010:0651 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | qspice-client | 0.3.0-4.el5_5 | RHSA-2010:0632 |
| Red Hat Rhel Productivity 5 | spice-xpi | 2.2-2.3.el5_5 | RHSA-2010:0651 |
Advisories 2
- RHSA-2010:0651 Red Hat Security Advisory: spice-xpi security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0632 Red Hat Security Advisory: qspice-client security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 67619 vdb-entry
- RHSA-2010:0651 vendor-advisory
- 41120 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=620350
- ADV-2010-2181 vdb-entry
- RHSA-2010:0632 vendor-advisory
- 42711 vdb-entry