Every CVE Search/ Get API key

CVE-2013-4130

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server...

5.0 MediumFix available

CVE-2013-4130 is a medium vulnerability (CVSS 5.0) in Spice Project Spice, published July 15, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in spice 0.12.4-0nocelt1.

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Exploit likelihood

2.63%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
CVE-2013-4130
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
CVE-2013-4130
Updated
2026-11-02
EUVDEUVD-2013-4058 No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
EUVD-2013-4058
Updated
2026-11-03
GitHub AdvisoriesGHSA-3mmx-gfx4-6h3r No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server...

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
GHSA-3mmx-gfx4-6h3r
Updated
2026-11-02
OSV No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
CVE-2013-4130
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4130 No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
DEBIAN-CVE-2013-4130
Updated
2026-11-02
OSVMGASA-2013-0255 No score

Updated spice packages fix CVE-2013-4130

Updated spice packages fix security vulnerability:

An user able to initiate spice connection to the guest could use a flaw in server/red_channel.c to crash the guest (CVE-2013-4130).

Record
MGASA-2013-0255
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4130 No score

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

Record
UBUNTU-CVE-2013-4130
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spice
Debian:12
 before 0.12.4-0nocelt1
0.12.4-0nocelt1
spice
Debian:13
 before 0.12.4-0nocelt1
0.12.4-0nocelt1
spice
Debian:14
 before 0.12.4-0nocelt1
0.12.4-0nocelt1
spice
Debian:7
 before 0.11.0-1+deb7u1, plus listed versions
0.11.0-1
0.11.0-1+deb7u1
spice
Mageia:2
 before 0.10.1-1.1.mga2
0.10.1-1.1.mga2
spice
Mageia:3
 before 0.12.2-5.1.mga3
0.12.2-5.1.mga3
spice-server
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-devel
Red Hat:enterprise_linux:6::client
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
Show 10 moreShow less
Affected packages
PackageAffectedFixed
spice-server-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-devel
Red Hat:enterprise_linux:6::computenode
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-devel
Red Hat:enterprise_linux:6::server
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
spice-server-devel
Red Hat:enterprise_linux:6::workstation
 before 0:0.12.0-12.el6_4.3
0:0.12.0-12.el6_4.3
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.4-20130912.1.el6_4
0:6.4-20130912.1.el6_4
spice
Ubuntu:14.04:LTS
 before 0.12.4-0nocelt1
0.12.4-0nocelt1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open