Every CVE Search/ Get API key

CVE-2015-5261

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to...

7.1 HighFix available

CVE-2015-5261 is a high vulnerability (CVSS 7.1) in Spice Project Spice, published October 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in spice 0.12.5-1.3.

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.47%Down 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.1

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
CVE-2015-5261
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
CVE-2015-5261
Updated
2026-11-02
EUVDEUVD-2015-5248 No score

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
EUVD-2015-5248
Updated
2026-11-03
GitHub AdvisoriesGHSA-w69p-8vxh-m87g 7.1

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to...

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
GHSA-w69p-8vxh-m87g
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-119
Updated
2026-11-02
OSV 7.1

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
CVE-2015-5261
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5261 7.1

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
DEBIAN-CVE-2015-5261
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2015-5261 7.1

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

Record
UBUNTU-CVE-2015-5261
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2015-0394 No score

Updated spice packages fix security vulnerabilities

Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtualization (CVE-2015-5260, CVE-2015-5261).

Record
MGASA-2015-0394
Updated
2026-11-02
OSVopenSUSE-SU-2024:10393-1 No score

libspice-server-devel-0.12.8-2.1 on GA media

These are all security issues fixed in the libspice-server-devel-0.12.8-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10393-1
Updated
2026-11-02
OSVSUSE-SU-2015:1733-1 No score

Security update for spice

Spice was updated to fix three security issues.

The following vulnerabilities were fixed:

  • CVE-2015-3247: heap corruption in the spice server (bsc#944460)
  • CVE-2015-5261: Guest could have accessed host memory using crafted images (bsc#948976)
  • CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944460)
Record
SUSE-SU-2015:1733-1
Updated
2026-11-02
OSVSUSE-SU-2016:1259-1 No score

Security update for spice

Spice was updated to fix three security issues.

The following vulnerabilities were fixed:

  • CVE-2015-3247: heap corruption in the spice server (bsc#944460)
  • CVE-2015-5261: Guest could have accessed host memory using crafted images (bsc#948976)
  • CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787)
Record
SUSE-SU-2016:1259-1
Updated
2026-11-02
OSVSUSE-SU-2016:1559-1 No score

Security update for spice

spice was updated to fix four security issues.

These security issues were fixed:

  • CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
  • CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).
  • CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787).
  • CVE-2015-5261: Host memory access from guest using crafted images (bsc#948976).
Record
SUSE-SU-2016:1559-1
Updated
2026-11-02
OSVUSN-2766-1 No score

spice vulnerabilities

Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtualization. (CVE-2015-5260, CVE-2015-5261)

Record
USN-2766-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spice
Debian:12
 before 0.12.5-1.3
0.12.5-1.3
spice
Debian:13
 before 0.12.5-1.3
0.12.5-1.3
spice
Debian:14
 before 0.12.5-1.3
0.12.5-1.3
spice
Debian:7
 before 0.11.0-1+deb7u2, plus listed versions
0.11.0-10.11.0-1+deb7u1
0.11.0-1+deb7u2
spice
Debian:8
 before 0.12.5-1+deb8u2, plus listed versions
0.12.5-10.12.5-1+deb8u1
0.12.5-1+deb8u2
spice
Mageia:5
 before 0.12.5-2.2.mga5
0.12.5-2.2.mga5
spice-server
Red Hat:enterprise_linux:6::client
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-devel
Red Hat:enterprise_linux:6::client
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
Show 38 moreShow less
Affected packages
PackageAffectedFixed
spice-server-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-devel
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server
Red Hat:enterprise_linux:6::server
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-devel
Red Hat:enterprise_linux:6::server
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice-server-devel
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.4-12.el6_7.3
0:0.12.4-12.el6_7.3
spice
Red Hat:enterprise_linux:7::client
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server
Red Hat:enterprise_linux:7::client
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server-devel
Red Hat:enterprise_linux:7::client
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice
Red Hat:enterprise_linux:7::computenode
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server
Red Hat:enterprise_linux:7::computenode
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice
Red Hat:enterprise_linux:7::server
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server
Red Hat:enterprise_linux:7::server
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server-devel
Red Hat:enterprise_linux:7::server
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice
Red Hat:enterprise_linux:7::workstation
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server
Red Hat:enterprise_linux:7::workstation
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice-server-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.12.4-9.el7_1.3
0:0.12.4-9.el7_1.3
spice
SUSE:Linux Enterprise Desktop 12
 before 0.12.4-8.5.1
0.12.4-8.5.1
spice
SUSE:Linux Enterprise Software Development Kit 12
 before 0.12.4-8.5.1
0.12.4-8.5.1
spice
SUSE:Linux Enterprise Server 12
 before 0.12.4-8.5.1
0.12.4-8.5.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12
 before 0.12.4-8.5.1
0.12.4-8.5.1
spice
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 0.12.4-5.1
0.12.4-5.1
spice
SUSE:Linux Enterprise Server 11 SP4
 before 0.12.4-5.1
0.12.4-5.1
spice
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 0.12.4-5.1
0.12.4-5.1
spice
SUSE:Linux Enterprise Desktop 12 SP1
 before 0.12.5-4.1
0.12.5-4.1
spice
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 0.12.5-4.1
0.12.5-4.1
spice
SUSE:Linux Enterprise Server 12 SP1
 before 0.12.5-4.1
0.12.5-4.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 0.12.5-4.1
0.12.5-4.1
spice
Ubuntu:14.04:LTS
 before 0.12.4-0nocelt2ubuntu1.2, plus listed versions
0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu10.12.4-0nocelt2ubuntu1.1
0.12.4-0nocelt2ubuntu1.2
spice
Ubuntu:16.04:LTS
 before 0.12.5-1.1ubuntu2
0.12.5-1.1ubuntu2
spice
openSUSE:Tumbleweed
 before 0.12.8-2.1
0.12.8-2.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open