USN-4617-1: SPICE vdagent vulnerabilities
4 November 2020
Several security issues were fixed in SPICE vdagent.
Releases
Packages
- spice-vdagent - Spice agent for Linux
Details
Matthias Gerstner discovered that SPICE vdagent incorrectly handled the
active_xfers hash table. A local attacker could possibly use this issue to
cause SPICE vdagent to consume memory, resulting in a denial of service.
(CVE-2020-25650)
Matthias Gerstner discovered that SPICE vdagent incorrectly handled the
active_xfers hash table. A local attacker could possibly use this issue to
cause SPICE vdagent to consume memory, resulting in a denial of service, or
obtain sensitive file contents. (CVE-2020-25651)
Matthias Gerstner discovered that SPICE vdagent incorrectly handled a large
number of client connections. A local attacker could possibly use this
issue to cause SPICE vdagent to consume resources, resulting in a denial of
service. (CVE-2020-25652)
Matthias Gerstner discovered that SPICE vdagent incorrectly handled client
connections. A local attacker could possibly use this issue to obtain
sensitive information, paste clipboard contents, and transfer files into
the active session. (CVE-2020-25653)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.10
Ubuntu 20.04
Ubuntu 18.04
After a standard system update you need to reboot your computer to make
all the necessary changes.