CVE-2018-10873

Name
CVE-2018-10873
Description
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://gitlab.freedesktop.org/spice/spice-common/commit/bb15d4815ab586b4c4a20f4a565970a44824c42c
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10873
Third Party Advisory https://usn.ubuntu.com/3751-1/
Third Party Advisory http://www.securityfocus.com/bid/105152
Mailing List https://lists.debian.org/debian-lts-announce/2018/08/msg00038.html
Mailing List https://lists.debian.org/debian-lts-announce/2018/08/msg00037.html
Mailing List https://lists.debian.org/debian-lts-announce/2018/08/msg00035.html
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2732
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2731
Third Party Advisory https://www.debian.org/security/2018/dsa-4319
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:3470

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:* spice >= None < 0.14.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
spice edge-main 0.14.1-r0 None fixed
spice edge-main 0.12.8-r4 None possibly vulnerable
spice edge-main 0.12.8-r3 None possibly vulnerable
spice 3.22-main 0.14.1-r0 None fixed
spice 3.22-main 0.12.8-r4 None possibly vulnerable
spice 3.22-main 0.12.8-r3 None possibly vulnerable
spice 3.21-main 0.14.1-r0 None fixed
spice 3.21-main 0.12.8-r4 None possibly vulnerable
spice 3.21-main 0.12.8-r3 None possibly vulnerable
spice 3.20-main 0.14.1-r0 None fixed
spice 3.20-main 0.12.8-r4 None possibly vulnerable
spice 3.20-main 0.12.8-r3 None possibly vulnerable
spice 3.19-main 0.14.1-r0 None fixed
spice 3.19-main 0.12.8-r4 None possibly vulnerable
spice 3.19-main 0.12.8-r3 None possibly vulnerable
spice 3.18-main 0.14.1-r0 None fixed
spice 3.17-main 0.14.1-r0 None fixed
spice 3.12-main 0.14.1-r0 None fixed
spice 3.11-main 0.14.1-r0 None fixed
spice 3.10-main 0.14.1-r0 None fixed