CVE-2017-15108
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing...
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
CVE-2017-15108- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
CVE-2017-15108- Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2017-6573 No score
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
EUVD-2017-6573- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rx22-vq3w-89rg
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing...
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
GHSA-rx22-vq3w-89rg- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
CVE-2017-15108- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15108
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
DEBIAN-CVE-2017-15108- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-15108
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
- Record
UBUNTU-CVE-2017-15108- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0032 No score
Updated spice-vdagent package fixes security vulnerability
Improperly escaped save directory that is passed to the shell allows local attacker with access to the session the agent runs to inject arbitrary commands to be executed (CVE-2017-15108).
- Record
MGASA-2019-0032- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11399-1 No score
spice-vdagent-0.21.0-1.7 on GA media
These are all security issues fixed in the spice-vdagent-0.21.0-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11399-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0372-1 No score
security update for spice-vdagent
This update for spice-vdagent provides the following fixes:
This security issue was fixed:
- CVE-2017-15108: Properly escape save directory that is passed to the shell to prevent local attacker with access to the session the agent runs from injecting arbitrary commands to be executed (bsc#1070724).
This non-security issue was fixed:
- Implement endian swapping, required for big-endian guests to connect to the spice client successfully. (bsc#1012215)
- Record
SUSE-SU-2018:0372-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spice-vdagentDebian:12 |
before 0.18.0-1 | 0.18.0-1 |
spice-vdagentDebian:13 |
before 0.18.0-1 | 0.18.0-1 |
spice-vdagentDebian:14 |
before 0.18.0-1 | 0.18.0-1 |
spice-vdagentDebian:9 From an advisory covering 5 CVEs |
before 0.17.0-1+deb9u1, plus listed versions 0.17.0-1 |
0.17.0-1+deb9u1 |
spice-vdagentMageia:6 |
before 0.18.0-1.mga6 | 0.18.0-1.mga6 |
spice-vdagentSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentSUSE:Linux Enterprise Server 12 SP2 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spice-vdagentSUSE:Linux Enterprise Server 12 SP3 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 0.16.0-8.5.15 | 0.16.0-8.5.15 |
spice-vdagentUbuntu:16.04:LTS |
All versions, plus listed versions 0.15.0-1.3 |
None known |
spice-vdagentUbuntu:18.04:LTS |
before 0.17.0-1ubuntu2, plus listed versions 0.17.0-1ubuntu1 |
0.17.0-1ubuntu2 |
spice-vdagentopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.21.0-1.7 | 0.21.0-1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15108 is a high vulnerability (CVSS 7.8) in Red Hat, Inc. Spice-vdagent, published January 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in spice-vdagent 0.18.0-1.
References
security.gentoo.org/glsa/201804-09
cgit.freedesktop.org/spice/linux/vd_agent/commit?id=8ba174816d245757e743e636df357910e1d5eb61
lists.debian.org/debian-lts-announce/2021/01/msg00012.html
nvd.nist.gov/vuln/detail/CVE-2017-15108
github.com/advisories/GHSA-rx22-vq3w-89rg
security-tracker.debian.org/tracker/CVE-2017-15108
Show 10 moreShow less
advisories.mageia.org/MGASA-2019-0032.html
bugs.mageia.org/show_bug.cgi?id=22564
lists.opensuse.org/opensuse-updates/2018-02/msg00028.html
suse.com/support/update/announcement/2018/suse-su-20180372-1
bugzilla.suse.com/1012215
ubuntu.com/security/CVE-2017-15108
cve.org/CVERecord?id=CVE-2017-15108