Home / mailings [USN-2766-1] Spice vulnerabilities
Posted on 07 October 2015
Ubuntu Security--===============6264189996832287529==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="qDbXVdCdHGoSgWSk"
Content-Disposition: inline
--qDbXVdCdHGoSgWSk
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
==========================================================================
Ubuntu Security Notice USN-2766-1
October 07, 2015
spice vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
Summary:
Spice could be made to crash or run programs.
Software Description:
- spice: SPICE protocol client and server library
Details:
Frediano Ziglio discovered multiple buffer overflows, undefined behavior
signed integer operations, race conditions, memory leaks, and denial
of service issues in Spice. A malicious guest operating system could
potentially exploit these issues to escape virtualization. (CVE-2015-5260,
CVE-2015-5261)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
libspice-server1 0.12.5-1ubuntu0.2
Ubuntu 14.04 LTS:
libspice-server1 0.12.4-0nocelt2ubuntu1.2
After a standard system update you need to restart qemu guests to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2766-1
CVE-2015-5260, CVE-2015-5261
Package Information:
https://launchpad.net/ubuntu/+source/spice/0.12.5-1ubuntu0.2
https://launchpad.net/ubuntu/+source/spice/0.12.4-0nocelt2ubuntu1.2