Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in Spice
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in Spice
ID: USN-2766-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 15.04
Datum: Mi, 7. Oktober 2015, 10:40
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5261
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5260
Applikationen: Spice

Originalnachricht


--===============6264189996832287529==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="qDbXVdCdHGoSgWSk"
Content-Disposition: inline


--qDbXVdCdHGoSgWSk
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-2766-1
October 07, 2015

spice vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 15.04
- Ubuntu 14.04 LTS

Summary:

Spice could be made to crash or run programs.

Software Description:
- spice: SPICE protocol client and server library

Details:

Frediano Ziglio discovered multiple buffer overflows, undefined behavior
signed integer operations, race conditions, memory leaks, and denial
of service issues in Spice. A malicious guest operating system could
potentially exploit these issues to escape virtualization. (CVE-2015-5260,
CVE-2015-5261)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
libspice-server1 0.12.5-1ubuntu0.2

Ubuntu 14.04 LTS:
libspice-server1 0.12.4-0nocelt2ubuntu1.2

After a standard system update you need to restart qemu guests to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2766-1
CVE-2015-5260, CVE-2015-5261

Package Information:
https://launchpad.net/ubuntu/+source/spice/0.12.5-1ubuntu0.2
https://launchpad.net/ubuntu/+source/spice/0.12.4-0nocelt2ubuntu1.2


--qDbXVdCdHGoSgWSk
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJWFJy4AAoJEPMhclmdjS6XSLwIALI7un+PN2v3KwD6WCoLj+8a
efvudzMgorHtFwdg11prMSIq7dN3sJXkWcZz9PhAWMN/xRpJ6E0ZcVRUSlUzt+EF
qJG+Dczm32kNohaL6VymPR2fsNasuhEvd/XVa/woJ8XTxwxRl2gHn5rpWzVCA3SD
CCSZDr+9pbHo9BttICFKan/z+zJYw8xWBuYgNtWy5qbOK3kfhecRphSoxH1iFiBL
uqhsfG4OB5Z7scw+rjvLCaTXL1G04opKoKOLewoE62EpzxWW4Kl3Wccm+Xt67Alf
b+3s+GuB8GyR114Z/RkJW5QOq4C6EiguvNH8f+3uwbXDbvWEH2qgDmVMLmTOJNw=
=sl9Z
-----END PGP SIGNATURE-----

--qDbXVdCdHGoSgWSk--


--===============6264189996832287529==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============6264189996832287529==--
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung