Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:0372-1

Опубликовано: 06 фев. 2018
Источник: suse-cvrf

Описание

security update for spice-vdagent

This update for spice-vdagent provides the following fixes:

This security issue was fixed:

  • CVE-2017-15108: Properly escape save directory that is passed to the shell to prevent local attacker with access to the session the agent runs from injecting arbitrary commands to be executed (bsc#1070724).

This non-security issue was fixed:

  • Implement endian swapping, required for big-endian guests to connect to the spice client successfully. (bsc#1012215)

Список пакетов

SUSE Linux Enterprise Desktop 12 SP2
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Desktop 12 SP3
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server 12 SP2
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server 12 SP3
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server for SAP Applications 12 SP2
spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server for SAP Applications 12 SP3
spice-vdagent-0.16.0-8.5.15

Ссылки

Описание

spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP2:spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Desktop 12 SP3:spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server 12 SP2:spice-vdagent-0.16.0-8.5.15
SUSE Linux Enterprise Server 12 SP3:spice-vdagent-0.16.0-8.5.15
Ссылки