CVE-2018-10873
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for...
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
CVE-2018-10873- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2018-2939
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
EUVD-2018-2939- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2r4x-v526-vv9j
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for...
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
GHSA-2r4x-v526-vv9j- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
CVE-2018-10873- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-119, CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-10873
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
ALPINE-CVE-2018-10873- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2018-10873
CVE-2018-10873 does not affect BellSoft software
- Record
BELL-CVE-2018-10873- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 20 moreShow less
OSV
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
CVE-2018-10873- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10873
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
DEBIAN-CVE-2018-10873- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2018:2731
Red Hat Security Advisory: spice and spice-gtk security update
- Record
RHSA-2018:2731- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2018:2732
Red Hat Security Advisory: spice-gtk and spice-server security update
- Record
RHSA-2018:2732- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2018:3470
Red Hat Security Advisory: Red Hat Virtualization security and bug fix update
- Record
RHSA-2018:3470- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10873
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
- Record
UBUNTU-CVE-2018-10873- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0099 No score
Updated spice-gtk packages fix security vulnerability
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable. (CVE-2017-12194)
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. (CVE-2018-10873)
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. (CVE-2018-10893)
- Record
MGASA-2019-0099- Updated
- 2026-11-02
OSVMGASA-2019-0100 No score
Updated spice packages fix security vulnerability
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. (CVE-2019-3813)
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. (CVE-2018-10873)
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. (CVE-2018-10893)
- Record
MGASA-2019-0100- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11397-1 No score
libspice-server-devel-0.15.0-1.3 on GA media
These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11397-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11398-1 No score
libspice-client-glib-2_0-8-0.39-1.8 on GA media
These are all security issues fixed in the libspice-client-glib-2_0-8-0.39-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11398-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2563-1 No score
Security update for spice
This update for spice fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2563-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2566-1 No score
Security update for spice
This update for spice fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2566-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2584-1 No score
Security update for spice
This update for spice fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2584-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2593-1 No score
Security update for spice-gtk
This update for spice-gtk fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2593-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2594-1 No score
Security update for spice-gtk
This update for spice-gtk fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2594-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2595-1 No score
Security update for spice
This update for spice fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2018:2595-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2709-1 No score
Security update for spice-gtk
This update for spice-gtk fixes the following issues:
Security issues fixed:
- CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)
Other bugs fixed:
- Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420)
- Record
SUSE-SU-2018:2709-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3841-1 No score
Security update for spice-gtk
This update for spice-gtk fixes the following issues:
- CVE-2018-10873: Fixed a potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Fixed a buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2020:3841-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3842-1 No score
Security update for spice
This update for spice fixes the following issues:
- CVE-2018-10873: Fixed a potential heap corruption when demarshalling (bsc#1104448)
- CVE-2018-10893: Fixed a buffer overflow on image lz checks (bsc#1101295)
- Record
SUSE-SU-2020:3842-1- Updated
- 2026-11-02
OSVUSN-3751-1 No score
spice, spice-protocol vulnerability
It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-3751-1- Updated
- 2026-11-02
Affected products
- spice project spice
- [unknown] spice:
- canonical ubuntu linux
- debian linux
- redhat enterprise linux desktop
- redhat enterprise linux server
- redhat enterprise linux server aus
- redhat enterprise linux server eus
- redhat enterprise linux server tus
- redhat enterprise linux workstation
- redhat virtualization
- redhat virtualization host
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spiceAlpine:v3.10 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.11 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.12 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.13 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.14 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.15 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.16 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.17 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.18 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.19 |
before 0.14.1-r0 | 0.14.1-r0 |
Show 138 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spiceAlpine:v3.20 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.21 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.22 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.23 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.24 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.5 |
before 0.12.8-r4 | 0.12.8-r4 |
spiceAlpine:v3.6 |
before 0.13.3-r3 | 0.13.3-r3 |
spiceAlpine:v3.7 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.8 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceAlpine:v3.9 |
before 0.14.1-r0 | 0.14.1-r0 |
spiceDebian:12 |
before 0.14.0-1.1 | 0.14.0-1.1 |
spiceDebian:13 |
before 0.14.0-1.1 | 0.14.0-1.1 |
spiceDebian:14 |
before 0.14.0-1.1 | 0.14.0-1.1 |
spice-gtkDebian:12 |
before 0.35-1 | 0.35-1 |
spice-gtkDebian:13 |
before 0.35-1 | 0.35-1 |
spice-gtkDebian:14 |
before 0.35-1 | 0.35-1 |
spiceDebian:8 |
before 0.12.5-1+deb8u6, plus listed versions 0.12.5-10.12.5-1+deb8u10.12.5-1+deb8u20.12.5-1+deb8u30.12.5-1+deb8u40.12.5-1+deb8u5 |
0.12.5-1+deb8u6 |
spice-gtkDebian:8 |
before 0.25-1+deb8u1, plus listed versions 0.25-1 |
0.25-1+deb8u1 |
spiceDebian:9 |
before 0.12.8-2.1+deb9u2, plus listed versions 0.12.8-2.10.12.8-2.1+deb9u1 |
0.12.8-2.1+deb9u2 |
spice-gtkMageia:6 |
before 0.33-3.1.mga6 | 0.33-3.1.mga6 |
spiceMageia:6 |
before 0.13.90-1.2.mga6 | 0.13.90-1.2.mga6 |
spiceRed Hat:enterprise_linux:7::client |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-debuginfoRed Hat:enterprise_linux:7::client |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glibRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtkRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-debuginfoRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3Red Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-serverRed Hat:enterprise_linux:7::client |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glib-develRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-toolsRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-develRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-valaRed Hat:enterprise_linux:7::client |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-server-develRed Hat:enterprise_linux:7::client |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spiceRed Hat:enterprise_linux:7::computenode |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-serverRed Hat:enterprise_linux:7::computenode |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-server-develRed Hat:enterprise_linux:7::computenode |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spiceRed Hat:enterprise_linux:7::server |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-debuginfoRed Hat:enterprise_linux:7::server |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glibRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtkRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-debuginfoRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3Red Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-serverRed Hat:enterprise_linux:7::server |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glib-develRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-toolsRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-develRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-valaRed Hat:enterprise_linux:7::server |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-server-develRed Hat:enterprise_linux:7::server |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spiceRed Hat:enterprise_linux:7::workstation |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glibRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtkRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3Red Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-serverRed Hat:enterprise_linux:7::workstation |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glib-develRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk-toolsRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-develRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-gtk3-valaRed Hat:enterprise_linux:7::workstation |
before 0:0.34-3.el7_5.2 | 0:0.34-3.el7_5.2 |
spice-server-develRed Hat:enterprise_linux:7::workstation |
before 0:0.14.0-2.el7_5.5 | 0:0.14.0-2.el7_5.5 |
spice-glibRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtkRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-serverRed Hat:enterprise_linux:6::client |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-server-debuginfoRed Hat:enterprise_linux:6::client |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glib-develRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-develRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::client |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-server-develRed Hat:enterprise_linux:6::client |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glibRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtkRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-serverRed Hat:enterprise_linux:6::computenode |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-server-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glib-develRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-develRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::computenode |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-server-develRed Hat:enterprise_linux:6::computenode |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glibRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtkRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-serverRed Hat:enterprise_linux:6::server |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-server-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glib-develRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-develRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::server |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-server-develRed Hat:enterprise_linux:6::server |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glibRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtkRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-serverRed Hat:enterprise_linux:6::workstation |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-server-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
spice-glib-develRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-develRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::workstation |
before 0:0.26-8.el6_10.1 | 0:0.26-8.el6_10.1 |
spice-server-develRed Hat:enterprise_linux:6::workstation |
before 0:0.12.4-16.el6_10.1 | 0:0.12.4-16.el6_10.1 |
redhat-virtualization-hostRed Hat:enterprise_linux:7::hypervisor |
before 0:4.2-20181026.0.el7_6 | 0:4.2-20181026.0.el7_6 |
redhat-virtualization-host-image-updateRed Hat:enterprise_linux:7::hypervisor |
before 0:4.2-20181026.0.el7_6 | 0:4.2-20181026.0.el7_6 |
imgbasedRed Hat:enterprise_linux:7::hypervisor |
before 0:1.0.29-1.el7ev | 0:1.0.29-1.el7ev |
python-imgbasedRed Hat:enterprise_linux:7::hypervisor |
before 0:1.0.29-1.el7ev | 0:1.0.29-1.el7ev |
redhat-release-virtualization-hostRed Hat:enterprise_linux:7::hypervisor |
before 0:4.2-7.3.el7 | 0:4.2-7.3.el7 |
redhat-virtualization-host-image-update-placeholderRed Hat:enterprise_linux:7::hypervisor |
before 0:4.2-7.3.el7 | 0:4.2-7.3.el7 |
spiceSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.12.4-15.1 | 0.12.4-15.1 |
spiceSUSE:Linux Enterprise Server 11 SP4 |
before 0.12.4-15.1 | 0.12.4-15.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 0.12.4-15.1 | 0.12.4-15.1 |
spiceSUSE:Linux Enterprise Module for Server Applications 15 |
before 0.14.0-4.3.1 | 0.14.0-4.3.1 |
spiceSUSE:Linux Enterprise Server 12-LTSS |
before 0.12.4-8.18.1 | 0.12.4-8.18.1 |
spice-gtkSUSE:Linux Enterprise Server 12-LTSS |
before 0.25-5.3.1 | 0.25-5.3.1 |
spice-gtkSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.33-3.6.1 | 0.33-3.6.1 |
spice-gtkSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.33-3.6.1 | 0.33-3.6.1 |
spice-gtkSUSE:Linux Enterprise Server 12 SP3 |
before 0.33-3.6.1 | 0.33-3.6.1 |
spice-gtkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 0.33-3.6.1 | 0.33-3.6.1 |
spiceSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.12.8-6.1 | 0.12.8-6.1 |
spiceSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.12.8-6.1 | 0.12.8-6.1 |
spiceSUSE:Linux Enterprise Server 12 SP3 |
before 0.12.8-6.1 | 0.12.8-6.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 0.12.8-6.1 | 0.12.8-6.1 |
spice-gtkSUSE:Linux Enterprise Module for Basesystem 15 |
before 0.34-3.3.1 | 0.34-3.3.1 |
spice-gtkSUSE:Linux Enterprise Module for Server Applications 15 |
before 0.34-3.3.1 | 0.34-3.3.1 |
spice-gtkSUSE:OpenStack Cloud 7 |
before 0.31-9.10.1 | 0.31-9.10.1 |
spice-gtkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 0.31-9.10.1 | 0.31-9.10.1 |
spice-gtkSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 0.31-9.10.1 | 0.31-9.10.1 |
spice-gtkSUSE:Linux Enterprise Server 12 SP2-BCL |
before 0.31-9.10.1 | 0.31-9.10.1 |
spiceSUSE:OpenStack Cloud 7 |
before 0.12.7-10.9.1 | 0.12.7-10.9.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 0.12.7-10.9.1 | 0.12.7-10.9.1 |
spiceSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 0.12.7-10.9.1 | 0.12.7-10.9.1 |
spiceSUSE:Linux Enterprise Server 12 SP2-BCL |
before 0.12.7-10.9.1 | 0.12.7-10.9.1 |
spiceUbuntu:14.04:LTS |
before 0.12.4-0nocelt2ubuntu1.7, plus listed versions 0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu1 Show 6 moreShow less0.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.30.12.4-0nocelt2ubuntu1.40.12.4-0nocelt2ubuntu1.50.12.4-0nocelt2ubuntu1.6 |
0.12.4-0nocelt2ubuntu1.7 |
spice-protocolUbuntu:16.04:LTS |
before 0.12.10-1ubuntu0.2, plus listed versions 0.12.7-10.12.10-10.12.10-1ubuntu0.1 |
0.12.10-1ubuntu0.2 |
spice-gtkUbuntu:16.04:LTS |
All versions, plus listed versions 0.28-1ubuntu10.29-10.30-1 |
None known |
spiceUbuntu:18.04:LTS |
before 0.14.0-1ubuntu2.2, plus listed versions 0.12.8-2.20.14.0-10.14.0-1ubuntu10.14.0-1ubuntu20.14.0-1ubuntu2.1 |
0.14.0-1ubuntu2.2 |
spice-gtkUbuntu:18.04:LTS |
All versions, plus listed versions 0.33-3.30.34-1.10.34-1.1build1 |
None known |
spiceopenSUSE:Tumbleweed |
before 0.15.0-1.3 | 0.15.0-1.3 |
spice-gtkopenSUSE:Tumbleweed |
before 0.39-1.8 | 0.39-1.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10873 is a high vulnerability (CVSS 8.3) in Spice Project Spice, published August 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.93%, the 90th percentile. Fixed in spice 0.14.1-r0.
References
debian.org/security/2018/dsa-4319
lists.debian.org/debian-lts-announce/2018/08/msg00035.html
usn.ubuntu.com/3751-1
access.redhat.com/errata/RHSA-2018:2732
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10873
Show 136 moreShow less
securityfocus.com/bid/105152
gitlab.freedesktop.org/spice/spice-common/commit/bb15d4815ab586b4c4a20f4a565970a44824c42c
nvd.nist.gov/vuln/detail/CVE-2018-10873
github.com/advisories/GHSA-2r4x-v526-vv9j
security.alpinelinux.org/vuln/CVE-2018-10873
docs.bell-sw.com/security/cves/CVE-2018-10873
security-tracker.debian.org/tracker/CVE-2018-10873
advisories.mageia.org/MGASA-2019-0099.html
bugs.mageia.org/show_bug.cgi?id=23466
lists.opensuse.org/opensuse-updates/2018-04/msg00011.html
openwall.com/lists/oss-security/2018/08/17/1
openwall.com/lists/oss-security/2019/01/28/2
lists.fedoraproject.org/archives/list/[email protected]/thread/OWH2AHGKTPR5QUGXUYGY6CAEI3O7RPLL
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2731.json
cve.org/CVERecord?id=CVE-2018-10873
samba.org/samba/security/CVE-2018-10858.html
suse.com/support/update/announcement/2018/suse-su-20182563-1
bugzilla.suse.com/1101295
ubuntu.com/security/CVE-2018-10873