Frediano Ziglio

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A buffer overflow exists in the `drivers/xen/sys-hypervisor.c` file. The build ID returned by the `HYPERVISOR xen version(XENVER build id)` function is not a string and lacks NUL termination. Consequently, the `sprintf()` function in `buildid show()` continues reading and copying data until a NUL character is encountered, leading to a buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.14.2-1 spice-gtk versions prior to 0.14.2-1 **Description** The issue is related to buffer overflow vulnerabilities in the QUIC image decoding process of the SPICE remote display system. These vulnerabilities can be exploited by a malicious client or server sending specially crafted messages, which can result in a process crash or potential code execution when processed by the QUIC image compression algorithm. This could allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For SPICE versions prior to 0.14.2-1, update to version 0.14.2-1 or later to resolve the issue. For spice-gtk versions prior to 0.14.2-1, update to version 0.14.2-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the QUIC image decoding process until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.14.1 **Description** A vulnerability was discovered in the demarshalling of messages, where the generated code lacked sufficient bounds checks. This could allow a malicious client or server, after authentication, to send specially crafted messages to its peer, resulting in a crash or potentially other impacts. The issue is related to errors in message processing, leading to buffer overflow. Exploitation of the vulnerability could allow a remote attacker to access confidential information or cause a denial of service. **Recommendations** For versions prior to 0.14.1, update to version 0.14.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `demarshal.py` function or the `write validate array item()` function until a patch is available. Avoid using the vulnerable demarshalling code in the SPICE protocol until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** spice-client (affected versions not specified) **Description** The issue is related to integer overflow in the spice-client software for remote access. It may allow a remote attacker to gain access to confidential information or cause a denial of service. Additionally, multiple integer overflow and buffer overflow issues were found in the handling of LZ compressed frames, which could cause the client to crash or potentially execute arbitrary code if a malicious server is involved. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** spice-gtk versions through 0.34 **Description** A flaw in the spice-client's message processing from the server allows an attacker with control of a malicious spice-server to potentially crash the client or execute arbitrary code with the permissions of the user running the client. The issue is related to insufficient input validation, which can be exploited by a remote attacker using specially crafted server messages. **Recommendations** For spice-gtk versions through 0.34, consider disabling the spice-client until a patch is available to prevent potential exploitation. Restrict access to the spice-server to minimize the risk of remote attackers sending malicious messages. Avoid using the spice-client with untrusted spice-servers until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.13.90 **Description** A vulnerability was discovered in the server's protocol handling, allowing an attacker who can connect to the SPICE server to send crafted messages, causing the process to crash. **Recommendations** For versions prior to 0.13.90, update to version 0.13.90 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.13.90 **Description** A vulnerability was discovered in the server's protocol handling, allowing an authenticated attacker to send crafted messages to the SPICE server. This could cause a heap overflow, leading to a crash or possible code execution. **Recommendations** For versions prior to 0.13.90, update to version 0.13.90 or later to resolve the issue. As a temporary workaround, consider restricting access to the SPICE server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.12.6 **Description** The issue allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation. **Recommendations** For versions prior to 0.12.6, update to version 0.12.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SPICE versions prior to 0.12.6 **Description** The issue allows guest OS users to cause a denial of service, resulting in heap-based memory corruption and QEMU-KVM crash, or possibly execute arbitrary code on the host. This is achieved via QXL commands related to the `surface id` parameter. **Recommendations** For versions prior to 0.12.6, update to version 0.12.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of QXL commands related to the `surface id` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SPICE version 0.12.4 **Description** A race condition in the `worker update monitors config` function allows a remote authenticated guest user to cause a denial of service, resulting in heap-based memory corruption and QEMU-KVM crash, or possibly execute arbitrary code on the host. **Recommendations** For SPICE version 0.12.4, consider disabling the `worker update monitors config` function as a temporary workaround until a patch is available. Restrict access to the QEMU-KVM process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.