CVE-2018-10873

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable. (CVE-2017-12194)

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. (CVE-2018-10873)

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. (CVE-2018-10893)

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. (CVE-2019-3813)

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. (CVE-2018-10873)

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. (CVE-2018-10893)

These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libspice-client-glib-2_0-8-0.39-1.8 package on the GA media of openSUSE Tumbleweed.

This update for spice fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice-gtk fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice-gtk fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

This update for spice-gtk fixes the following issues:

Security issues fixed:

• CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

Other bugs fixed:

• Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420)

This update for spice-gtk fixes the following issues:

• CVE-2018-10873: Fixed a potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Fixed a buffer overflow on image lz checks (bsc#1101295)

This update for spice fixes the following issues:

• CVE-2018-10873: Fixed a potential heap corruption when demarshalling (bsc#1104448)
• CVE-2018-10893: Fixed a buffer overflow on image lz checks (bsc#1101295)

It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service.