CVE-2015-5261 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
HighCVSS 7.1
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/spice(Debian:12) | < 0.12.5-1.3 | 0.12.5-1.3 |
| debian/spice(Debian:13) | < 0.12.5-1.3 | 0.12.5-1.3 |
| debian/spice(Debian:14) | < 0.12.5-1.3 | 0.12.5-1.3 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server eus | = 6.7.z | No fix listed |
| redhat enterprise linux server eus | = 7.1 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| spice project spice | <= 0.12.5 | No fix listed |
References
- Debian Security Tracker CVE-2015-5261 vendor-advisory
- [Spice-devel] 20151006 Announcing spice 0.12.6 mailing-list
- RHSA-2015:1889 vendor-advisory
- RHSA-2015:1890 vendor-advisory
- DSA-3371 vendor-advisory
- [oss-security] 20151006 Fwd: [vs-plain] CVE-2015-5261 mailing-list
- www.oracle.com
- 1033753 vdb-entry
- USN-2766-1 vendor-advisory
- bugzilla.redhat.com
- GLSA-201606-05 vendor-advisory
- bugs.debian.org issue-tracking