Your submission was sent successfully! Close

CVE-2018-10873

Published: 17 August 2018

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Priority

Medium

CVSS 3 base score: 8.8

Status

Package Release Status
spice
Launchpad, Ubuntu, Debian
Upstream
Released (0.14.0-1.1)
Ubuntu 21.10 (Impish Indri)
Released (0.14.0-1ubuntu4)
Ubuntu 21.04 (Hirsute Hippo)
Released (0.14.0-1ubuntu4)
Ubuntu 20.04 LTS (Focal Fossa)
Released (0.14.0-1ubuntu4)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (0.14.0-1ubuntu2.2)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable

Ubuntu 14.04 ESM (Trusty Tahr)
Released (0.12.4-0nocelt2ubuntu1.7)
spice-gtk
Launchpad, Ubuntu, Debian
Upstream
Released (0.35-1)
Ubuntu 21.10 (Impish Indri) Not vulnerable
(0.35-2)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(0.35-2)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(0.35-2)
Ubuntu 18.04 LTS (Bionic Beaver) Needed

Ubuntu 16.04 ESM (Xenial Xerus) Ignored
(end of standard support, was needed)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needs-triage)
spice-protocol
Launchpad, Ubuntu, Debian
Upstream Not vulnerable

Ubuntu 21.10 (Impish Indri) Not vulnerable

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable

Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable

Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable

Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.12.10-1ubuntu0.2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected)