Описание
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | released | 0.17.0-1ubuntu2 |
| cosmic | released | 0.17.0-1ubuntu2 |
| devel | released | 0.17.0-1ubuntu2 |
| disco | released | 0.17.0-1ubuntu2 |
| eoan | released | 0.17.0-1ubuntu2 |
| esm-apps/xenial | needed | |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was needed] |
| esm-infra/bionic | released | 0.17.0-1ubuntu2 |
| esm-infra/focal | released | 0.17.0-1ubuntu2 |
Показывать по
Ссылки на источники
4.6 Medium
CVSS2
7.8 High
CVSS3
Связанные уязвимости
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
spice-vdagent up to and including 0.17.0 does not properly escape save ...
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
4.6 Medium
CVSS2
7.8 High
CVSS3