Every CVE Search/ Get API key

CVE-2013-4282

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0...

5.0 MediumFix available

CVE-2013-4282 is a medium vulnerability (CVSS 5.0) in Spice Project Spice, published November 2, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. Fixed in spice 0.12.4-0nocelt2.

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Exploit likelihood

2.73%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
CVE-2013-4282
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
CVE-2013-4282
Updated
2026-11-02
EUVDEUVD-2013-4180 No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
EUVD-2013-4180
Updated
2026-11-03
GitHub AdvisoriesGHSA-wr45-fcg3-r672 No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0...

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
GHSA-wr45-fcg3-r672
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
CVE-2013-4282
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4282 No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
DEBIAN-CVE-2013-4282
Updated
2026-11-02
Show 5 moreShow less
OSVMGASA-2014-0022 No score

Updated spice packages fix a security vulnerability

Updated spice packages fix security vulnerability:

A stack-based buffer overflow flaw was found in the way the reds_handle_ticket() function in the spice-server library handled decryption of ticket data provided by the client. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application (CVE-2013-4282).

Record
MGASA-2014-0022
Updated
2026-11-02
OSVopenSUSE-SU-2024:11397-1 No score

libspice-server-devel-0.15.0-1.3 on GA media

These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11397-1
Updated
2026-11-02
OSVSUSE-SU-2015:0884-1 No score

Security update for spice

The remote desktop software SPICE was updated to address one security issue.

The following vulnerabilitiy was fixed:

  • A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282)
Record
SUSE-SU-2015:0884-1
Updated
2026-11-02
OSVSUSE-SU-2015:0884-2 No score

Security update for spice

The remote desktop software SPICE was updated to address one security issue.

The following vulnerabilitiy was fixed:

  • A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282)
Record
SUSE-SU-2015:0884-2
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4282 No score

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Record
UBUNTU-CVE-2013-4282
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spice
Debian:12
 before 0.12.4-0nocelt2
0.12.4-0nocelt2
spice
Debian:13
 before 0.12.4-0nocelt2
0.12.4-0nocelt2
spice
Debian:14
 before 0.12.4-0nocelt2
0.12.4-0nocelt2
spice
Debian:7
 before 0.11.0-1+deb7u1, plus listed versions
0.11.0-1
0.11.0-1+deb7u1
spice
Mageia:3
 before 0.12.2-5.2.mga3
0.12.2-5.2.mga3
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.4-20131016.0.el6_4
0:6.4-20131016.0.el6_4
spice-server
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-devel
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
Show 26 moreShow less
Affected packages
PackageAffectedFixed
spice-server-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-devel
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-devel
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
spice-server-devel
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.5
0:0.12.0-12.el6_4.5
qspice
Red Hat:enterprise_linux:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-libs
Red Hat:enterprise_linux:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice
Red Hat:rhel_virtualization:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-debuginfo
Red Hat:rhel_virtualization:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-libs-devel
Red Hat:rhel_virtualization:5::client
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice
Red Hat:enterprise_linux:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-libs
Red Hat:enterprise_linux:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice
Red Hat:rhel_virtualization:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-debuginfo
Red Hat:rhel_virtualization:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
qspice-libs-devel
Red Hat:rhel_virtualization:5::server
 before 0:0.3.0-56.el5_10.1
0:0.3.0-56.el5_10.1
spice
SUSE:Linux Enterprise Desktop 12
 before 0.12.4-6.1
0.12.4-6.1
spice
SUSE:Linux Enterprise Server 12
 before 0.12.4-6.1
0.12.4-6.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12
 before 0.12.4-6.1
0.12.4-6.1
spice
SUSE:Linux Enterprise Software Development Kit 12
 before 0.12.4-6.1
0.12.4-6.1
spice
Ubuntu:14.04:LTS
 before 0.12.4-0nocelt1.1ubuntu1, plus listed versions
0.12.4-0nocelt10.12.4-0nocelt1.1
0.12.4-0nocelt1.1ubuntu1
spice
openSUSE:Tumbleweed
 before 0.15.0-1.3
0.15.0-1.3

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open