{"id":"CVE-2019-3813","aliases":["ALPINE-CVE-2019-3813","BELL-CVE-2019-3813","DEBIAN-CVE-2019-3813","DLA-1649-1","DSA-4375-1","EUVD-2019-13436","GHSA-j8r4-w4xh-mcv3","MGASA-2019-0100","RHSA-2019:0231","RHSA-2019:0232","RHSA-2019:0457","SUSE-SU-2019:0229-1","SUSE-SU-2019:0230-1","SUSE-SU-2019:0231-1","SUSE-SU-2019:0231-2","SUSE-SU-2019:0241-1","SUSE-SU-2019:0242-1","SUSE-SU-2019:13943-1","UBUNTU-CVE-2019-3813","USN-3870-1","openSUSE-SU-2019:0167-1","openSUSE-SU-2024:11397-1"],"status":"published","title":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by...","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01208,"percentile":0.68593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2019-01-28T18:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"spice","fixed_in":["0.13.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"spice","fixed_in":["0.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"spice","fixed_in":["0.14.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"spice","fixed_in":["0.14.1-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"spice","fixed_in":["0.14.0-1.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"spice","fixed_in":["0.14.0-1.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spice","fixed_in":["0.14.0-1.3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"spice","fixed_in":["0.12.5-1+deb8u7"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"spice","fixed_in":["0.12.8-2.1+deb9u3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-debuginfo","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server-devel","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-debuginfo","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server-devel","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-debuginfo","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server-devel","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-debuginfo","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server-devel","fixed_in":["0:0.14.0-6.el7_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-devel","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-devel","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-devel","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-debuginfo","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-devel","fixed_in":["0:0.12.4-16.el6_10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"spice","fixed_in":["0.12.4-8.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"spice","fixed_in":["0.12.7-10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"spice","fixed_in":["0.12.7-10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"spice","fixed_in":["0.12.7-10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"spice","fixed_in":["0.12.7-10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"spice","fixed_in":["0.12.7-10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"spice","fixed_in":["0.12.5-10.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"spice","fixed_in":["0.12.5-10.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"spice","fixed_in":["0.12.8-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"spice","fixed_in":["0.14.0-4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"spice","fixed_in":["0.12.4-18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"spice","fixed_in":["0.12.4-18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"spice","fixed_in":["0.12.4-18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"spice","fixed_in":["0.12.4-0nocelt2ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"spice","fixed_in":["0.12.6-4ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"spice","fixed_in":["0.14.0-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"spice","fixed_in":["0.14.0-lp150.3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.13.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.2"},{"fixed":"0.14.1-r4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-1+deb8u7"}]}],"versions":["0.12.5-1","0.12.5-1+deb8u1","0.12.5-1+deb8u2","0.12.5-1+deb8u3","0.12.5-1+deb8u4","0.12.5-1+deb8u5","0.12.5-1+deb8u6"]},{"source":"osv","ecosystem":"Debian:9","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-2.1+deb9u3"}]}],"versions":["0.12.8-2.1","0.12.8-2.1+deb9u1","0.12.8-2.1+deb9u2"]},{"source":"osv","ecosystem":"Mageia:6","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.90-1.2.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-6.el7_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"spice-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.4-16.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2-20190219.0.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2-20190219.0.el7_6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2-8.3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2-8.3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-8.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-10.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-10.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.8-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.8"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1","0.12.4-0nocelt2ubuntu1.1","0.12.4-0nocelt2ubuntu1.2","0.12.4-0nocelt2ubuntu1.3","0.12.4-0nocelt2ubuntu1.4","0.12.4-0nocelt2ubuntu1.5","0.12.4-0nocelt2ubuntu1.6","0.12.4-0nocelt2ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-4ubuntu0.4"}]}],"versions":["0.12.5-1.1ubuntu2","0.12.6-4","0.12.6-4ubuntu0.1","0.12.6-4ubuntu0.2","0.12.6-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1ubuntu2.4"}]}],"versions":["0.12.8-2.2","0.14.0-1","0.14.0-1ubuntu1","0.14.0-1ubuntu2","0.14.0-1ubuntu2.1","0.14.0-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.4-0nocelt2ubuntu1.8"}]}],"versions":["0.12.4-0nocelt1","0.12.4-0nocelt1.1","0.12.4-0nocelt1.1ubuntu1","0.12.4-0nocelt2","0.12.4-0nocelt2ubuntu1","0.12.4-0nocelt2ubuntu1.1","0.12.4-0nocelt2ubuntu1.2","0.12.4-0nocelt2ubuntu1.3","0.12.4-0nocelt2ubuntu1.4","0.12.4-0nocelt2ubuntu1.5","0.12.4-0nocelt2ubuntu1.6","0.12.4-0nocelt2ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-4ubuntu0.4"}]}],"versions":["0.12.5-1.1ubuntu2","0.12.6-4","0.12.6-4ubuntu0.1","0.12.6-4ubuntu0.2","0.12.6-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1ubuntu2.4"}]}],"versions":["0.12.8-2.2","0.14.0-1","0.14.0-1ubuntu1","0.14.0-1ubuntu2","0.14.0-1ubuntu2.1","0.14.0-1ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-lp150.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1.3"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"red hat, inc.","product":"spice"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"spice_project","product":"spice"}],"references":[{"url":"https://www.debian.org/security/2019/dsa-4375","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0231","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/106801","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0457","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665371","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/3870-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0232","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202007-30","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3813","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8r4-w4xh-mcv3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3813","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-3813","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3813","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0100.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24257","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/01/28/2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OWH2AHGKTPR5QUGXUYGY6CAEI3O7RPLL/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/08/17/1","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-09/msg00007.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-09/msg00010.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0231.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3813","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0232.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677667","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0457.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3831","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6454","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6454","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190229-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122706","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3813","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190230-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190231-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190241-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190242-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109044","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913943-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3813","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3870-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KOYZQCCPVZTLRGKL5HJUTHZCJ6BLDEZI/#KOYZQCCPVZTLRGKL5HJUTHZCJ6BLDEZI","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14355","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:00:00Z","modified":"2024-09-16T16:23:33.117Z","updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13436","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:00:00Z","modified":"2024-09-16T16:23:33Z","updated_at":"2026-11-03T00:55:52.084115Z"}],"ghsa":[{"id":"GHSA-j8r4-w4xh-mcv3","title":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by...","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2022-04-30T00:02:15Z","modified":"2023-01-30T05:04:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:46:57.05202Z"}],"nvd":[{"id":"CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:29:00.323Z","modified":"2026-06-17T02:35:38.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.4,"vector":"AV:A/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:29:00.323Z","modified":"2026-09-21T06:17:52.516613569Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-3813","title":"CVE-2019-3813 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:44.441278Z","modified":"2026-01-26T09:47:56.086563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:29:00.323Z","modified":"2026-10-24T10:30:49.118258338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-02-04T18:29:00.323Z","modified":"2026-09-21T07:03:18.92442755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2019:0231","title":"Red Hat Security Advisory: spice security update","status":"published","published":"2024-09-13T14:07:52Z","modified":"2026-06-28T10:28:20Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:0232","title":"Red Hat Security Advisory: spice-server security update","status":"published","published":"2024-09-13T14:07:58Z","modified":"2026-06-28T10:28:21Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:0457","title":"Red Hat Security Advisory: redhat-virtualization-host security update","status":"published","published":"2024-09-13T21:58:47Z","modified":"2026-06-28T10:28:35Z","cvss":[{"version":"3.0","score":8,"vector":"CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2019-3813","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.","status":"published","published":"2019-01-28T18:00:00Z","modified":"2026-04-22T11:57:18.415221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-1649-1","title":"spice - security update","status":"published","published":"2019-01-30T00:00:00Z","modified":"2026-03-09T01:21:38.793684Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4375-1","title":"spice - security update","status":"published","published":"2019-01-29T00:00:00Z","modified":"2026-03-09T02:10:55.519991Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0100","title":"Updated spice packages fix security vulnerability","description":"Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds\nread due to an off-by-one error in memslot_get_virt. This may lead to a\ndenial of service, or, in the worst case, code-execution by unauthenticated\nattackers. (CVE-2019-3813)\n\nA vulnerability was discovered in SPICE before version 0.14.1 where the\ngenerated code used for demarshalling messages lacked sufficient bounds\nchecks. A malicious client or server, after authentication, could send\nspecially crafted messages to its peer which would result in a crash or,\npotentially, other impacts. (CVE-2018-10873)\n\nMultiple integer overflow and buffer overflow issues were discovered in\nspice-client's handling of LZ compressed frames. A malicious server could\ncause the client to crash or, potentially, execute arbitrary code.\n(CVE-2018-10893)\n","status":"published","published":"2019-02-22T00:35:50Z","modified":"2026-04-16T04:42:44.888806413Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0167-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n\nNon-security issue fixed:\n\n- Include spice-server tweak to compensate for performance issues with Windows guests (bsc#1109044).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:57:40Z","modified":"2026-02-04T03:47:53.939072Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11397-1","title":"libspice-server-devel-0.15.0-1.3 on GA media","description":"These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:43.188907Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0229-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n","status":"published","published":"2019-02-05T09:11:30Z","modified":"2025-05-02T04:09:15.957171Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0230-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n","status":"published","published":"2019-02-05T09:12:43Z","modified":"2026-02-04T03:56:54.648532Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0231-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n","status":"published","published":"2019-02-05T09:13:04Z","modified":"2026-02-04T03:50:17.221316Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0231-2","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n","status":"published","published":"2019-04-29T05:56:32Z","modified":"2026-02-04T03:16:09.661466Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0241-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n","status":"published","published":"2019-02-05T12:57:40Z","modified":"2026-02-04T03:02:55.152219Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0242-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).\n\nNon-security issue fixed:\n\n- Include spice-server tweak to compensate for performance issues with Windows guests (bsc#1109044).\n","status":"published","published":"2019-02-05T12:57:50Z","modified":"2026-02-04T02:59:22.278301Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13943-1","title":"Security update for spice","description":"This update for spice fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3813: Fixed an out-of-bounds read in the memslot_get_virt function \n  that could lead to denial-of-service or code-execution (bsc#1122706).\n \n","status":"published","published":"2019-02-07T12:14:26Z","modified":"2025-05-02T04:09:16.318684Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3870-1","title":"spice vulnerability","description":"Christophe Fergeau discovered that Spice incorrectly handled memory. A\nremote attacker could use this to cause Spice to crash, resulting in a\ndenial of service, or possibly execute arbitrary code.\n","status":"published","published":"2019-01-28T19:07:13Z","modified":"2026-04-22T09:54:38.968042Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}