========================================================================== Ubuntu Security Notice USN-3659-1 May 23, 2018
spice, spice-protocol vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Spice could be made to crash or run programs if it received specially crafted network traffic. Software Description: - spice: SPICE protocol client and server library - spice-protocol: SPICE protocol headers Details: Frediano Ziglio discovered that Spice incorrectly handled certain client messages. An attacker could possibly use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: libspice-server1 0.14.0-1ubuntu2.1 Ubuntu 17.10: libspice-server1 0.12.8-2.2ubuntu0.1 Ubuntu 16.04 LTS: libspice-protocol-dev 0.12.10-1ubuntu0.1 Ubuntu 14.04 LTS: libspice-server1 0.12.4-0nocelt2ubuntu1.6 After a standard system update you need to restart qemu guests to make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3659-1 CVE-2017-12194 Package Information: https://launchpad.net/ubuntu/+source/spice/0.14.0-1ubuntu2.1 https://launchpad.net/ubuntu/+source/spice/0.12.8-2.2ubuntu0.1 https://launchpad.net/ubuntu/+source/spice-protocol/0.12.10-1ubuntu0.1 https://launchpad.net/ubuntu/+source/spice/0.12.4-0nocelt2ubuntu1.6
signature.asc
Description: This is a digitally signed message part
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
