Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2018:2730-1

Опубликовано: 15 сент. 2018
Источник: suse-cvrf

Описание

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

Security issues fixed:

  • CVE-2018-10873: Fix potential heap corruption when demarshalling (bsc#1104448)
  • CVE-2018-10893: Avoid buffer overflow on image lz checks (bsc#1101295)

Other bugs fixed:

  • Add setuid bit to spice-client-glib-usb-acl-helper (bsc#1101420)

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
libspice-client-glib-2_0-8-0.34-lp150.2.3.1
libspice-client-glib-helper-0.34-lp150.2.3.1
libspice-client-gtk-3_0-5-0.34-lp150.2.3.1
libspice-controller0-0.34-lp150.2.3.1
spice-gtk-0.34-lp150.2.3.1
spice-gtk-devel-0.34-lp150.2.3.1
spice-gtk-lang-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGlib-2_0-0.34-lp150.2.3.1
typelib-1_0-SpiceClientGtk-3_0-0.34-lp150.2.3.1

Ссылки

Описание

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Затронутые продукты
openSUSE Leap 15.0:libspice-client-glib-2_0-8-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-client-glib-helper-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-client-gtk-3_0-5-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-controller0-0.34-lp150.2.3.1
Ссылки

Описание

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.

Затронутые продукты
openSUSE Leap 15.0:libspice-client-glib-2_0-8-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-client-glib-helper-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-client-gtk-3_0-5-0.34-lp150.2.3.1
openSUSE Leap 15.0:libspice-controller0-0.34-lp150.2.3.1
Ссылки