{"id":"CVE-2016-9578","aliases":["ALPINE-CVE-2016-9578","BELL-CVE-2016-9578","DEBIAN-CVE-2016-9578","DLA-825-1","DSA-3790-1","EUVD-2016-10384","GHSA-9m3r-8p8r-j38x","MGASA-2017-0062","RHSA-2017:0253","RHSA-2017:0254","RHSA-2017:0549","RHSA-2017:0552","SUSE-SU-2017:0392-1","SUSE-SU-2017:0393-1","SUSE-SU-2017:0396-1","SUSE-SU-2017:0400-1","UBUNTU-CVE-2016-9578","USN-3202-1","openSUSE-SU-2024:11397-1"],"status":"published","title":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An...","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0246,"percentile":0.84559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-770"],"published":"2017-02-06T00:00:00Z","modified":"2026-10-24T10:30:21Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"spice","fixed_in":["0.12.8-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"spice","fixed_in":["0.12.8-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"spice","fixed_in":["0.12.8-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spice","fixed_in":["0.12.8-2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"spice","fixed_in":["0.12.4-0nocelt2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"spice","fixed_in":["0.12.6-4ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-2.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1+deb7u4"}]}],"versions":["0.11.0-1","0.11.0-1+deb7u1","0.11.0-1+deb7u2","0.11.0-1+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1+deb8u4"}]}],"versions":["0.12.5-1","0.12.5-1+deb8u1","0.12.5-1+deb8u2","0.12.5-1+deb8u3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2.4.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-13.el6_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-20.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0-20170307.1.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0-20170307.1.el7_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"imgbased","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.16-0.1.el7ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0-7.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0-7.1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"rhevm-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.20170307.0-1.el7ev"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.4"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1","0.12.4-0nocelt2ubuntu1.1","0.12.4-0nocelt2ubuntu1.2","0.12.4-0nocelt2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-4ubuntu0.2"}]}],"versions":["0.12.5-1.1ubuntu2","0.12.6-4","0.12.6-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.4"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1","0.12.4-0nocelt2ubuntu1.1","0.12.4-0nocelt2ubuntu1.2","0.12.4-0nocelt2ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-4ubuntu0.2"}]}],"versions":["0.12.5-1.1ubuntu2","0.12.6-4","0.12.6-4ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1.3"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"red hat","product":"spice"},{"vendor":"red hat, inc.","product":"spice"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"spice_project","product":"spice"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9578","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0552","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0254","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/96118","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3790","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0253.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0549.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9578","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9m3r-8p8r-j38x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9578","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9578","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9578","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0062.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20251","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2017-0254.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0253","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1399566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401603","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0253.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9578","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0254.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0549","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1403729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1410848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1422476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1426012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1426038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1428375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1430244","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0549.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419968","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0552.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170392-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1023078","tags":["report"]},{"url":"https://bugzilla.suse.com/1023079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9578","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170393-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170396-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170400-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9578","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3202-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9577","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14355","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:00:00Z","modified":"2024-08-06T02:59:02.515Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10384","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:00:00Z","modified":"2024-08-06T02:59:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:22:26.803486Z"}],"ghsa":[{"id":"GHSA-9m3r-8p8r-j38x","title":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An...","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2022-05-13T01:38:29Z","modified":"2023-02-01T05:08:57Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:29:00.243Z","modified":"2026-06-17T00:56:16.663Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"ALPINE-CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:29:00.243Z","modified":"2026-09-22T06:17:50.252234551Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2016-9578","title":"CVE-2016-9578 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:49.118415Z","modified":"2026-01-26T09:47:01.208707Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:29:00.243Z","modified":"2026-10-24T10:30:21.082228215Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2018-07-27T21:29:00.243Z","modified":"2026-09-22T07:00:56.8317751Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"RHSA-2017:0253","title":"Red Hat Security Advisory: spice-server security update","status":"published","published":"2024-09-13T14:39:11Z","modified":"2026-07-01T10:01:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0254","title":"Red Hat Security Advisory: spice security update","status":"published","published":"2024-09-13T14:39:05Z","modified":"2026-07-01T10:01:41Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0549","title":"Red Hat Security Advisory: redhat-virtualization-host security and bug fix update","status":"published","published":"2024-09-13T14:38:57Z","modified":"2026-07-01T10:01:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0552","title":"Red Hat Security Advisory: rhevm-appliance security and bug fix update","status":"published","published":"2024-09-13T14:38:51Z","modified":"2026-07-01T10:01:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-9578","description":"A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.","status":"published","published":"2017-02-06T00:00:00Z","modified":"2026-04-22T11:05:33.33725Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-825-1","title":"spice - security update","status":"published","published":"2017-02-17T00:00:00Z","modified":"2026-03-09T02:08:52.213473Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3790-1","title":"spice - security update","status":"published","published":"2017-02-16T00:00:00Z","modified":"2026-03-09T01:23:15.641611Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0062","title":"Updated spice packages fix security vulnerability","description":"An authenticated attacker could send crafted messages to the spice server\ncausing a heap overflow leading to a crash or possible code execution.\n(CVE-2016-9577)\n\nAn attacker able to connect to the spice server could send crafted\nmessages which would cause the process to crash. (CVE-2016-9578)\n","status":"published","published":"2017-02-23T14:58:52Z","modified":"2026-04-16T06:23:32.806975033Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11397-1","title":"libspice-server-devel-0.15.0-1.3 on GA media","description":"These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:43.188907Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:0392-1","title":"Security update for spice","description":"\nThis security update for spice fixes the following issues:\n\nCVE-2016-9577: A buffer overflow in the spice server could have potentially been used \nby unauthenticated attackers to execute arbitrary code. (bsc#1023078)\nCVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)\n","status":"published","published":"2017-02-06T11:09:42Z","modified":"2026-02-04T04:32:25.611035Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0393-1","title":"Security update for spice","description":"\nThis security update for spice fixes the following issues:\n\nCVE-2016-9577: A buffer overflow in the spice server could have potentially been used \nby unauthenticated attackers to execute arbitrary code. (bsc#1023078)\nCVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)\n","status":"published","published":"2017-02-06T10:56:07Z","modified":"2026-02-04T04:22:52.947693Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0396-1","title":"Security update for spice","description":"\nThis security update for spice fixes the following issues:\n\nCVE-2016-9577: A buffer overflow in the spice server could have potentially been used \nby unauthenticated attackers to execute arbitrary code. (bsc#1023078)\nCVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)\n","status":"published","published":"2017-02-06T10:55:00Z","modified":"2026-02-04T02:16:21.733571Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0400-1","title":"Security update for spice","description":"\nThis security update for spice fixes the following issues:\n\nCVE-2016-9577: A buffer overflow in the spice server could have potentially been used \nby unauthenticated attackers to execute arbitrary code. (bsc#1023078)\nCVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079)\n","status":"published","published":"2017-02-06T10:55:25Z","modified":"2026-02-04T03:54:50.433196Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3202-1","title":"spice vulnerabilities","description":"Frediano Ziglio discovered that Spice incorrectly handled certain client\nmessages. A remote attacker could use this issue to cause Spice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2017-02-20T17:46:32Z","modified":"2026-04-22T09:32:44.045298Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}