SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

The remote SUSE Linux SLES11 / SLES_SAP11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14744-1 advisory.

  - SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted     primary surface parameters, a similar issue to CVE-2015-5261. (CVE-2016-2150)

  - Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote     display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these     flaws. These flaws allow a malicious client or server to send specially crafted messages that, when     processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
    (CVE-2020-14355)

  - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers     to cause a denial of service (CPU consumption) by performing many renegotiations within a single     connection. (CVE-2021-20201)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to new 0.12.8 upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream 0.12.8 release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice was updated to fix two security issues.

These security issues were fixed :

  - CVE-2016-2150: SPICE allowed local guest OS users to     read from or write to arbitrary host memory locations     via crafted primary surface parameters, a similar issue     to CVE-2015-5261 (boo#982385).

  - CVE-2016-0749: The smartcard interaction in SPICE     allowed remote attackers to cause a denial of service     (QEMU-KVM process crash) or possibly execute arbitrary     code via vectors related to connecting to a guest VM,     which triggers a heap-based buffer overflow     (boo#982385).

A vulnerability has been found in the Simple Protocol for Independent Computing Environments, SPICE.

Frediano Ziglio from Red Hat discovered that SPICE allowed local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters.

For Debian 7 'Wheezy', this problem has been fixed in version 0.11.0-1+deb7u3.

We recommend you to upgrade your spice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)

Frediano Ziglio discovered that Spice incorrectly handled certain primary surface parameters. A malicious guest operating system could potentially exploit this issue to escape virtualization.
(CVE-2016-2150).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice was updated to fix two security issues.

These security issues were fixed :

  - CVE-2016-2150: Guest escape using crafted primary     surface parameters (bsc#982386).

  - CVE-2016-0749: Heap-based buffer overflow in smartcard     interaction (bsc#982385).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice was updated to fix four security issues.

These security issues were fixed :

  - CVE-2016-2150: Guest escape using crafted primary     surface parameters (bsc#982386).

  - CVE-2016-0749: Heap-based buffer overflow in smartcard     interaction (bsc#982385).

  - CVE-2015-5260: Insufficient validation of surface_id     parameter could have caused a crash (bsc#944787).

  - CVE-2015-5261: Host memory access from guest using     crafted images (bsc#948976).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A memory allocation flaw, leading to a heap-based buffer     overflow, was found in spice's smartcard interaction,     which runs under the QEMU-KVM context on the host. A     user connecting to a guest VM using spice could     potentially use this flaw to crash the QEMU-KVM process     or execute arbitrary code with the privileges of the     host's QEMU-KVM process. (CVE-2016-0749)

  - A memory access flaw was found in the way spice handled     certain guests using crafted primary surface parameters.
    A user in a guest could use this flaw to read from and     write to arbitrary memory locations on the host.
    (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

The remote host is affected by the vulnerability described in GLSA-201606-05 (spice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in spice, please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code. Additionally, a       local attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - A memory allocation flaw, leading to a heap-based buffer     overflow, was found in spice's smartcard interaction,     which runs under the QEMU-KVM context on the host. A     user connecting to a guest VM using spice could     potentially use this flaw to crash the QEMU-KVM process     or execute arbitrary code with the privileges of the     host's QEMU-KVM process. (CVE-2016-0749)

  - A memory access flaw was found in the way spice handled     certain guests using crafted primary surface parameters.
    A user in a guest could use this flaw to read from and     write to arbitrary memory locations on the host.
    (CVE-2016-2150)

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

From Red Hat Security Advisory 2016:1205 :

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

From Red Hat Security Advisory 2016:1204 :

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-0749     Jing Zhao of Red Hat discovered a memory allocation     flaw, leading to a heap-based buffer overflow in spice's     smartcard interaction. A user connecting to a guest VM     via spice can take advantage of this flaw to cause a     denial-of-service (QEMU process crash), or potentially     to execute arbitrary code on the host with the     privileges of the hosting QEMU process.

  - CVE-2016-2150     Frediano Ziglio of Red Hat discovered that a malicious     guest inside a virtual machine can take control of the     corresponding QEMU process in the host using crafted     primary surface parameters.

ID	Name	Product	Family	Severity
150653	SUSE SLES11 Security Update : spice (SUSE-SU-2021:14744-1)	Nessus	SuSE Local Security Checks	high
93032	Fedora 23 : spice (2016-a7322c9fd1)	Nessus	Fedora Local Security Checks	critical
92443	Fedora 24 : spice (2016-6b9c658707)	Nessus	Fedora Local Security Checks	critical
91944	openSUSE Security Update : spice (openSUSE-2016-824)	Nessus	SuSE Local Security Checks	critical
91943	openSUSE Security Update : spice (openSUSE-2016-823)	Nessus	SuSE Local Security Checks	critical
91859	Debian DLA-531-1 : spice security update	Nessus	Debian Local Security Checks	high
91758	Ubuntu 14.04 LTS / 16.04 LTS : Spice vulnerabilities (USN-3014-1)	Nessus	Ubuntu Local Security Checks	critical
91661	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1561-1)	Nessus	SuSE Local Security Checks	critical
91659	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1559-1)	Nessus	SuSE Local Security Checks	critical
91647	Scientific Linux Security Update : spice-server on SL6.x x86_64 (20160606)	Nessus	Scientific Linux Local Security Checks	critical
91638	GLSA-201606-05 : spice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91514	Scientific Linux Security Update : spice on SL7.x x86_64 (20160606)	Nessus	Scientific Linux Local Security Checks	critical
91504	CentOS 7 : spice (CESA-2016:1205)	Nessus	CentOS Local Security Checks	critical
91503	CentOS 6 : spice-server (CESA-2016:1204)	Nessus	CentOS Local Security Checks	critical
91496	RHEL 7 : spice (RHSA-2016:1205)	Nessus	Red Hat Local Security Checks	critical
91495	RHEL 6 : spice-server (RHSA-2016:1204)	Nessus	Red Hat Local Security Checks	critical
91494	Oracle Linux 7 : spice (ELSA-2016-1205)	Nessus	Oracle Linux Local Security Checks	critical
91493	Oracle Linux 6 : spice-server (ELSA-2016-1204)	Nessus	Oracle Linux Local Security Checks	critical
91490	Debian DSA-3596-1 : spice - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-2150

high

Tenable Plugins

high

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical