CVE-2016-9577
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An...
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
CVE-2016-9577- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2016-10383
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
EUVD-2016-10383- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjp3-q3m4-wmjx
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An...
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
GHSA-fjp3-q3m4-wmjx- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
CVE-2016-9577- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20, CWE-122, CWE-119
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-9577
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
ALPINE-CVE-2016-9577- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2016-9577
CVE-2016-9577 does not affect BellSoft software
- Record
BELL-CVE-2016-9577- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSV
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
CVE-2016-9577- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-9577
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
DEBIAN-CVE-2016-9577- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0253
Red Hat Security Advisory: spice-server security update
- Record
RHSA-2017:0253- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0254
Red Hat Security Advisory: spice security update
- Record
RHSA-2017:0254- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0549
Red Hat Security Advisory: redhat-virtualization-host security and bug fix update
- Record
RHSA-2017:0549- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0552
Red Hat Security Advisory: rhevm-appliance security and bug fix update
- Record
RHSA-2017:0552- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9577
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
- Record
UBUNTU-CVE-2016-9577- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0062 No score
Updated spice packages fix security vulnerability
An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)
An attacker able to connect to the spice server could send crafted messages which would cause the process to crash. (CVE-2016-9578)
- Record
MGASA-2017-0062- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11397-1 No score
libspice-server-devel-0.15.0-1.3 on GA media
These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11397-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0392-1 No score
Security update for spice
This security update for spice fixes the following issues:
CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)
- Record
SUSE-SU-2017:0392-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0393-1 No score
Security update for spice
This security update for spice fixes the following issues:
CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)
- Record
SUSE-SU-2017:0393-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0396-1 No score
Security update for spice
This security update for spice fixes the following issues:
CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)
- Record
SUSE-SU-2017:0396-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0400-1 No score
Security update for spice
This security update for spice fixes the following issues:
CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)
- Record
SUSE-SU-2017:0400-1- Updated
- 2026-11-02
OSVUSN-3202-1 No score
spice vulnerabilities
Frediano Ziglio discovered that Spice incorrectly handled certain client messages. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3202-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spiceAlpine:v3.10 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.11 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.12 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.13 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.14 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.15 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.16 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.17 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.18 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.19 |
before 0.12.8-r3 | 0.12.8-r3 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spiceAlpine:v3.20 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.21 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.22 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.23 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.24 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.7 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.8 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceAlpine:v3.9 |
before 0.12.8-r3 | 0.12.8-r3 |
spiceDebian:12 |
before 0.12.8-2.1 | 0.12.8-2.1 |
spiceDebian:13 |
before 0.12.8-2.1 | 0.12.8-2.1 |
spiceDebian:14 |
before 0.12.8-2.1 | 0.12.8-2.1 |
spiceDebian:7 From an advisory covering 2 CVEs |
before 0.11.0-1+deb7u4, plus listed versions 0.11.0-10.11.0-1+deb7u10.11.0-1+deb7u20.11.0-1+deb7u3 |
0.11.0-1+deb7u4 |
spiceDebian:8 From an advisory covering 2 CVEs |
before 0.12.5-1+deb8u4, plus listed versions 0.12.5-10.12.5-1+deb8u10.12.5-1+deb8u20.12.5-1+deb8u3 |
0.12.5-1+deb8u4 |
spiceMageia:5 From an advisory covering 2 CVEs |
before 0.12.5-2.4.mga5 | 0.12.5-2.4.mga5 |
spice-serverRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-develRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-serverRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-develRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-serverRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-develRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-serverRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spice-server-develRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-13.el6_8.2 | 0:0.12.4-13.el6_8.2 |
spiceRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-serverRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-server-develRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spiceRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-serverRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-server-develRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spiceRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-serverRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-server-develRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spiceRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-serverRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
spice-server-develRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.12.4-20.el7_3 | 0:0.12.4-20.el7_3 |
redhat-virtualization-hostRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 0:4.0-20170307.1.el7_3 | 0:4.0-20170307.1.el7_3 |
redhat-virtualization-host-image-updateRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 0:4.0-20170307.1.el7_3 | 0:4.0-20170307.1.el7_3 |
imgbasedRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 0:0.8.16-0.1.el7ev | 0:0.8.16-0.1.el7ev |
redhat-release-virtualization-hostRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 0:4.0-7.1.el7 | 0:4.0-7.1.el7 |
redhat-virtualization-host-image-update-placeholderRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 0:4.0-7.1.el7 | 0:4.0-7.1.el7 |
rhevm-applianceRed Hat:enterprise_linux:7::hypervisor From an advisory covering 2 CVEs |
before 1:4.0.20170307.0-1.el7ev | 1:4.0.20170307.0-1.el7ev |
spiceSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 2 CVEs |
before 0.12.7-8.1 | 0.12.7-8.1 |
spiceSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 2 CVEs |
before 0.12.7-8.1 | 0.12.7-8.1 |
spiceSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 2 CVEs |
before 0.12.7-8.1 | 0.12.7-8.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 2 CVEs |
before 0.12.7-8.1 | 0.12.7-8.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 2 CVEs |
before 0.12.4-8.12.1 | 0.12.4-8.12.1 |
spiceSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 2 CVEs |
before 0.12.4-8.12.1 | 0.12.4-8.12.1 |
spiceSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 2 CVEs |
before 0.12.4-8.1 | 0.12.4-8.1 |
spiceSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 2 CVEs |
before 0.12.4-8.1 | 0.12.4-8.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 2 CVEs |
before 0.12.4-8.1 | 0.12.4-8.1 |
spiceSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 2 CVEs |
before 0.12.5-7.1 | 0.12.5-7.1 |
spiceSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 2 CVEs |
before 0.12.5-7.1 | 0.12.5-7.1 |
spiceSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 2 CVEs |
before 0.12.5-7.1 | 0.12.5-7.1 |
spiceSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 2 CVEs |
before 0.12.5-7.1 | 0.12.5-7.1 |
spiceUbuntu:14.04:LTS |
before 0.12.4-0nocelt2ubuntu1.4, plus listed versions 0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu10.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.3 |
0.12.4-0nocelt2ubuntu1.4 |
spiceUbuntu:16.04:LTS |
before 0.12.6-4ubuntu0.2, plus listed versions 0.12.5-1.1ubuntu20.12.6-40.12.6-4ubuntu0.1 |
0.12.6-4ubuntu0.2 |
spiceUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 0.12.4-0nocelt2ubuntu1.4, plus listed versions 0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu10.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.3 |
0.12.4-0nocelt2ubuntu1.4 |
spiceUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 0.12.6-4ubuntu0.2, plus listed versions 0.12.5-1.1ubuntu20.12.6-40.12.6-4ubuntu0.1 |
0.12.6-4ubuntu0.2 |
spiceopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 0.15.0-1.3 | 0.15.0-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9577 is a high vulnerability (CVSS 7.5) in Red Hat Spice, published December 31, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.79%, the 90th percentile. Fixed in spice 0.12.8-r3.
References
access.redhat.com/errata/RHSA-2017:0552
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9577
debian.org/security/2017/dsa-3790
securityfocus.com/bid/96040
rhn.redhat.com/errata/RHSA-2017-0253.html
Show 52 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-9577
github.com/advisories/GHSA-fjp3-q3m4-wmjx
security.alpinelinux.org/vuln/CVE-2016-9577
docs.bell-sw.com/security/cves/CVE-2016-9577
security-tracker.debian.org/tracker/CVE-2016-9577
advisories.mageia.org/MGASA-2017-0062.html
bugs.mageia.org/show_bug.cgi?id=20251
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0253.json
cve.org/CVERecord?id=CVE-2016-9577
suse.com/support/update/announcement/2017/suse-su-20170392-1
bugzilla.suse.com/1023078
ubuntu.com/security/CVE-2016-9577