{"id":"CVE-2015-3247","aliases":["DEBIAN-CVE-2015-3247","DSA-3354-1","EUVD-2015-3302","GHSA-jcpp-w729-jxmc","MGASA-2015-0373","RHSA-2015:1713","RHSA-2015:1714","RHSA-2015:1715","SUSE-SU-2015:1733-1","SUSE-SU-2016:1259-1","UBUNTU-CVE-2015-3247","USN-2736-1","openSUSE-SU-2024:10393-1"],"status":"published","title":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote...","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","severity":{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01144,"percentile":0.66945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-362"],"published":"2015-09-03T00:00:00Z","modified":"2026-09-09T06:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"spice","fixed_in":["0.12.5-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"spice","fixed_in":["0.12.5-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spice","fixed_in":["0.12.5-1.2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"spice","fixed_in":["0.12.5-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"spice","fixed_in":["0.12.4-4.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"spice","fixed_in":["0.12.5-2.1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-debuginfo","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server-devel","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-debuginfo","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server-devel","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-debuginfo","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server-devel","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-debuginfo","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server-devel","fixed_in":["0:0.12.4-9.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-devel","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-devel","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-devel","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-devel","fixed_in":["0:0.12.4-12.el6_7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"spice","fixed_in":["0.12.4-0nocelt2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1.2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1+deb8u1"}]}],"versions":["0.12.5-1"]},{"source":"osv","ecosystem":"Mageia:4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-4.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7-20150828.0.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1-20150827.1.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"rhev-hypervisor7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1-20150827.1.el7ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-9.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-12.el6_7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.1"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.1"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-2.1"}]}],"bundled":5}],"products":[{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"spice_project","product":"spice"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2736-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3354","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1715.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-09/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1033460","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1033459","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1033753","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1714.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1713.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3247","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1713","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1714","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1715","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1233238","tags":["report"]},{"url":"https://github.com/advisories/GHSA-jcpp-w729-jxmc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3247","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0373.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16700","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-1714.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1231027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1233145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1248942","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1713.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8137","tags":["advisory"]},{"url":"http://www.ocert.org/advisories/ocert-2014-012.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8138","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8138","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1841","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1841","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3247","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1714.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1715.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151733-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/944460","tags":["report"]},{"url":"https://bugzilla.suse.com/948976","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/944787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3247","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2736-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2150","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3247","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-08T15:00:00Z","modified":"2024-08-06T05:39:32.149Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3302","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-08T15:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-jcpp-w729-jxmc","title":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote...","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2022-05-14T01:08:49Z","modified":"2023-02-10T05:06:15Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2015-3247","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-08T15:59:02.72Z","modified":"2026-06-17T00:25:36.843Z","cvss":[{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-362"],"updated_at":"2026-11-02T14:03:09.92183Z"}],"osv":[{"id":"CVE-2015-3247","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-08T15:59:02Z","modified":"2026-04-16T06:17:19.804722237Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3247","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-08T15:59:02.72Z","modified":"2026-09-09T06:47:25.610632217Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3354-1","title":"spice - security update","status":"published","published":"2015-09-08T00:00:00Z","modified":"2026-03-09T01:18:38.656764Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0373","title":"Updated spice packages fix CVE-2015-3247","description":"Updated spice packages fix security vulnerability:\n\nA race condition flaw, leading to a heap-based memory corruption, was found\nin spice's worker_update_monitors_config() function, which runs under the\nQEMU-KVM context on the host. A user in a guest could leverage this flaw to\ncrash the host QEMU-KVM process or, possibly, execute arbitrary code with\nthe privileges of the host QEMU-KVM process (CVE-2015-3247).\n","status":"published","published":"2015-09-15T14:55:06Z","modified":"2026-04-16T06:24:02.617729713Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10393-1","title":"libspice-server-devel-0.12.8-2.1 on GA media","description":"These are all security issues fixed in the libspice-server-devel-0.12.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:25.810817Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2015:1713","title":"Red Hat Security Advisory: rhev-hypervisor security, bug fix, and enhancement update","status":"published","published":"2024-09-13T10:37:59Z","modified":"2026-06-29T10:10:04Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1714","title":"Red Hat Security Advisory: spice security update","status":"published","published":"2024-09-13T10:38:06Z","modified":"2026-06-29T10:10:05Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1715","title":"Red Hat Security Advisory: spice-server security update","status":"published","published":"2024-09-13T10:38:10Z","modified":"2026-06-29T10:10:05Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:1733-1","title":"Security update for spice","description":"Spice was updated to fix three security issues.\n    \nThe following vulnerabilities were fixed:  \n* CVE-2015-3247: heap corruption in the spice server (bsc#944460)\n* CVE-2015-5261: Guest could have accessed host memory using crafted images (bsc#948976)\n* CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944460)\n","status":"published","published":"2015-10-07T07:34:48Z","modified":"2026-02-04T04:20:44.226556Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:1259-1","title":"Security update for spice","description":"Spice was updated to fix three security issues.\n    \nThe following vulnerabilities were fixed:  \n  \n* CVE-2015-3247: heap corruption in the spice server (bsc#944460)\n* CVE-2015-5261: Guest could have accessed host memory using crafted images (bsc#948976)\n* CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787)\n","status":"published","published":"2016-05-07T07:47:04Z","modified":"2026-02-04T04:24:36.672569Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2015-3247","description":"Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.","status":"published","published":"2015-09-03T00:00:00Z","modified":"2026-04-22T10:07:03.514787Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2736-1","title":"spice vulnerability","description":"Frediano Ziglio discovered that Spice incorrectly handled monitor configs.\nA malicious guest could use this issue to cause a denial of service, or\npossibly execute arbitrary code on the host as the user running the QEMU\nprocess. In the default installation, when QEMU is used with libvirt,\nattackers would be isolated by the libvirt AppArmor profile.\n","status":"published","published":"2015-09-08T14:01:24Z","modified":"2026-04-22T09:16:12.339392Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}