advisories/24257.adv

type: security
subject: Updated spice packages fix security vulnerability
CVE:
 - CVE-2019-3813
 - CVE-2018-10873
 - CVE-2018-10893
src:
  6:
   core:
     - spice-0.13.90-1.2.mga6
description: |
  Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds
  read due to an off-by-one error in memslot_get_virt. This may lead to a
  denial of service, or, in the worst case, code-execution by unauthenticated
  attackers. (CVE-2019-3813)

  A vulnerability was discovered in SPICE before version 0.14.1 where the
  generated code used for demarshalling messages lacked sufficient bounds
  checks. A malicious client or server, after authentication, could send
  specially crafted messages to its peer which would result in a crash or,
  potentially, other impacts. (CVE-2018-10873)

  Multiple integer overflow and buffer overflow issues were discovered in
  spice-client's handling of LZ compressed frames. A malicious server could
  cause the client to crash or, potentially, execute arbitrary code.
  (CVE-2018-10893)
references:
 - https://bugs.mageia.org/show_bug.cgi?id=24257
 - https://www.openwall.com/lists/oss-security/2019/01/28/2
 - https://access.redhat.com/errata/RHSA-2019:0231
 - https://usn.ubuntu.com/3870-1/
 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OWH2AHGKTPR5QUGXUYGY6CAEI3O7RPLL/
 - http://openwall.com/lists/oss-security/2018/08/17/1
 - https://lists.opensuse.org/opensuse-updates/2018-09/msg00007.html
 - https://lists.opensuse.org/opensuse-updates/2018-09/msg00010.html
ID: MGASA-2019-0100
1	type: security
2	subject: Updated spice packages fix security vulnerability
3	CVE:
4	- CVE-2019-3813
5	- CVE-2018-10873
6	- CVE-2018-10893
7	src:
8	6:
9	core:
10	- spice-0.13.90-1.2.mga6
11	description: \|
12	Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds
13	read due to an off-by-one error in memslot_get_virt. This may lead to a
14	denial of service, or, in the worst case, code-execution by unauthenticated
15	attackers. (CVE-2019-3813)
16
17	A vulnerability was discovered in SPICE before version 0.14.1 where the
18	generated code used for demarshalling messages lacked sufficient bounds
19	checks. A malicious client or server, after authentication, could send
20	specially crafted messages to its peer which would result in a crash or,
21	potentially, other impacts. (CVE-2018-10873)
22
23	Multiple integer overflow and buffer overflow issues were discovered in
24	spice-client's handling of LZ compressed frames. A malicious server could
25	cause the client to crash or, potentially, execute arbitrary code.
26	(CVE-2018-10893)
27	references:
28	- https://bugs.mageia.org/show_bug.cgi?id=24257
29	- https://www.openwall.com/lists/oss-security/2019/01/28/2
30	- https://access.redhat.com/errata/RHSA-2019:0231
31	- https://usn.ubuntu.com/3870-1/
32	- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OWH2AHGKTPR5QUGXUYGY6CAEI3O7RPLL/
33	- http://openwall.com/lists/oss-security/2018/08/17/1
34	- https://lists.opensuse.org/opensuse-updates/2018-09/msg00007.html
35	- https://lists.opensuse.org/opensuse-updates/2018-09/msg00010.html
36	ID: MGASA-2019-0100