Arch Linux Security Advisory ASA-201510-13 ========================================== Severity: High Date : 2015-10-19 CVE-ID : CVE-2015-3247 CVE-2015-5260 CVE-2015-5261 Package : spice Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package spice before version 0.12.6-1 is vulnerable to multiple issues, including denial of service and privilege escalation. Resolution ========== Upgrade to 0.12.6-1. # pacman -Syu "spice>=0.12.6-1" The problem has been fixed upstream in version 0.12.6. Workaround ========== None. Description =========== - CVE-2015-3247 (race condition flaw): A race condition flaw was found in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5260 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surface_id" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5261 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host. Impact ====== A rogue guest user can cause a denial of service to the host or execute arbitrary command with the privileges of the host QEMU-KVM process. References ========== https://bugs.archlinux.org/task/46738 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3247 https://access.redhat.com/security/cve/CVE-2015-5260 https://access.redhat.com/security/cve/CVE-2015-5261 http://lists.freedesktop.org/archives/spice-devel/2015-October/022168.html