PT-2017-3269 · Red Hat+4 · Spice+5

Publicado 2017-01-17 · Atualizado 2023-02-12 · CVE-2017-7506

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions spice versions prior to 0.14

Description The issue is related to out-of-bounds memory access when processing specially crafted messages from an authenticated attacker to the spice server, resulting in a crash and/or server memory leak. It is also described as a buffer overflow vulnerability, which can allow a remote attacker to cause a denial of service or execute arbitrary code using a specially crafted message.

Recommendations For spice versions prior to 0.14, update to version 0.14 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-1042

BDU:2018-00028

CESA-2017_2471

CESA-2018_3522

CVE-2017-7506

DSA-3907-1

MGASA-2017-0239

OPENSUSE-SU-2017_1843-1

OPENSUSE-SU-2017_2604-1

RHSA-2017:2471

RHSA-2017_2471

RHSA-2018:3522

RHSA-2018_3522

SUSE-SU-2017:1832-1

SUSE-SU-2017:1836-1

SUSE-SU-2017:1837-1

SUSE-SU-2017:1839-1

SUSE-SU-2017:2552-1

SUSE-SU-2017_1832-1

SUSE-SU-2017_1836-1

SUSE-SU-2017_1837-1

SUSE-SU-2017_1839-1

SUSE-SU-2017_2552-1

USN-3355-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Spice

Referências · 64

• https://osv.dev/vulnerability/SUSE-SU-2017:1837-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/07/14/1 · Nota
• https://ubuntu.com/security/notices/USN-3355-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2017:1839-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1452606 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7506 · Aviso do Fabricante
• http://debian.org/security/2017/dsa-3907 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2017:1836-1 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/VMHO7G3VMF2PVMOPV4TS45MAKTEHU2LJ · Nota
• https://osv.dev/vulnerability/MGASA-2017-0239 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2017-7506 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2017-July/003025.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7506 · Nota de Segurança
• https://cgit.freedesktop.org/spice/spice/tree/NEWS?id=34dff543bef7a5201f41c72353a65840bd37c275 · Nota
• https://linux.oracle.com/errata/ELSA-2017-2471.html · Aviso do Fabricante