The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) plugin/nsScriptablePeer.cpp and (2) plugin/plugin.cpp, which trigger multiple uses of an uninitialized pointer.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2011-154:01 advisory.

    SPICE extension for mozilla allows the client to be used from a web browser.
    Security issues fixed with this release:
    CVE-2011-0012     CVE-2011-1179     No description available at the time of writing, see CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1)     plugin/nsScriptablePeer.cpp and (2) plugin/plugin.cpp, which trigger multiple uses of an uninitialized     pointer. (CVE-2011-1179)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2011-0426 advisory.

    - Fix security vulnerability CVE-2011-0012 (rhbz#639869)       Resolves: rhbz#639870

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated spice-xpi package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor, or on Red Hat Enterprise Virtualization Hypervisor.

The spice-xpi package provides a plug-in that allows the SPICE client to run from within Mozilla Firefox.

An uninitialized pointer use flaw was found in the SPICE Firefox plug-in. If a user were tricked into visiting a malicious web page with Firefox while the SPICE plug-in was enabled, it could cause Firefox to crash or, possibly, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-1179)

Users of spice-xpi should upgrade to this updated package, which contains a backported patch to correct this issue. After installing the update, Firefox must be restarted for the changes to take effect.

An uninitialized pointer use flaw was found in the SPICE Firefox plug-in. If a user were tricked into visiting a malicious web page with Firefox while the SPICE plug-in was enabled, it could cause Firefox to crash or, possibly, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-1179)

It was found that the SPICE Firefox plug-in used a predictable name for one of its log files. A local attacker could use this flaw to conduct a symbolic link attack, allowing them to overwrite arbitrary files accessible to the user running Firefox. (CVE-2011-0012)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:0426 advisory.

    The Simple Protocol for Independent Computing Environments (SPICE) is a     remote display protocol used in Red Hat Enterprise Linux for viewing     virtualized guests running on the Kernel-based Virtual Machine (KVM)     hypervisor, or on Red Hat Enterprise Virtualization Hypervisor.

    The spice-xpi package provides a plug-in that allows the SPICE client to     run from within Mozilla Firefox.

    An uninitialized pointer use flaw was found in the SPICE Firefox plug-in.
    If a user were tricked into visiting a malicious web page with Firefox     while the SPICE plug-in was enabled, it could cause Firefox to crash or,     possibly, execute arbitrary code with the privileges of the user running     Firefox. (CVE-2011-1179)

    It was found that the SPICE Firefox plug-in used a predictable name for one     of its log files. A local attacker could use this flaw to conduct a     symbolic link attack, allowing them to overwrite arbitrary files accessible     to the user running Firefox. (CVE-2011-0012)

    Users of spice-xpi should upgrade to this updated package, which contains     backported patches to correct these issues. After installing the update,     Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
284038	MiracleLinux 4 : spice-xpi-2.4-1.AXS4.2 (AXSA:2011-154:01)	Nessus	Miracle Linux Local Security Checks	critical
217338	Linux Distros Unpatched Vulnerability : CVE-2011-1179	Nessus	Misc.	critical
68250	Oracle Linux 6 : spice-xpi (ELSA-2011-0426)	Nessus	Oracle Linux Local Security Checks	critical
63976	RHEL 5 : spice-xpi (RHSA-2011:0427)	Nessus	Red Hat Local Security Checks	medium
61013	Scientific Linux Security Update : spice-xpi on SL5.x,SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53431	CentOS 5 : spice-xpi (CESA-2011:0427)	Nessus	CentOS Local Security Checks	medium
53329	RHEL 6 : spice-xpi (RHSA-2011:0426)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-1179

critical

Tenable Plugins

critical

critical

critical

medium

medium

medium

critical