ID |
CVE-2018-10893
|
Summary |
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. |
References |
|
Vulnerable Configurations |
|
CVSS |
Base: | 6.5 (as of 12-02-2023 - 23:31) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-122 |
CAPEC |
-
Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
SINGLE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
PARTIAL |
PARTIAL |
|
cvss-vector
via4
|
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
redhat
via4
|
advisories | bugzilla | id | 1686008 | title | errors in journal |
| oval | OR | comment | Red Hat Enterprise Linux must be installed | oval | oval:com.redhat.rhba:tst:20070304026 |
AND | comment | Red Hat Enterprise Linux 7 is installed | oval | oval:com.redhat.rhba:tst:20150364027 |
OR | AND | comment | spice-glib is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229001 |
comment | spice-glib is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284002 |
|
AND | comment | spice-glib-devel is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229003 |
comment | spice-glib-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284004 |
|
AND | comment | spice-gtk-tools is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229005 |
comment | spice-gtk-tools is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284012 |
|
AND | comment | spice-gtk3 is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229007 |
comment | spice-gtk3 is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20182731008 |
|
AND | comment | spice-gtk3-devel is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229009 |
comment | spice-gtk3-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20182731010 |
|
AND | comment | spice-gtk3-vala is earlier than 0:0.35-4.el7 | oval | oval:com.redhat.rhsa:tst:20192229011 |
comment | spice-gtk3-vala is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20182731012 |
|
AND | comment | spice-vdagent is earlier than 0:0.14.0-18.el7 | oval | oval:com.redhat.rhsa:tst:20192229013 |
comment | spice-vdagent is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20192229014 |
|
AND | comment | libgovirt is earlier than 0:0.3.4-3.el7 | oval | oval:com.redhat.rhsa:tst:20192229015 |
comment | libgovirt is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20183140356 |
|
AND | comment | libgovirt-devel is earlier than 0:0.3.4-3.el7 | oval | oval:com.redhat.rhsa:tst:20192229017 |
comment | libgovirt-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20183140358 |
|
AND | comment | virt-viewer is earlier than 0:5.0-15.el7 | oval | oval:com.redhat.rhsa:tst:20192229019 |
comment | virt-viewer is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20192229020 |
|
|
|
|
| rhsa | id | RHSA-2019:2229 | released | 2019-08-06 | severity | Moderate | title | RHSA-2019:2229: spice-gtk security and bug fix update (Moderate) |
|
bugzilla | id | 1598234 | title | CVE-2018-10893 spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows |
| oval | OR | comment | Red Hat Enterprise Linux must be installed | oval | oval:com.redhat.rhba:tst:20070304026 |
AND | comment | Red Hat Enterprise Linux 6 is installed | oval | oval:com.redhat.rhba:tst:20111656003 |
OR | AND | comment | spice-glib is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471001 |
comment | spice-glib is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284002 |
|
AND | comment | spice-glib-devel is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471003 |
comment | spice-glib-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284004 |
|
AND | comment | spice-gtk is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471005 |
comment | spice-gtk is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284006 |
|
AND | comment | spice-gtk-devel is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471007 |
comment | spice-gtk-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284008 |
|
AND | comment | spice-gtk-python is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471009 |
comment | spice-gtk-python is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284010 |
|
AND | comment | spice-gtk-tools is earlier than 0:0.26-8.el6_10.2 | oval | oval:com.redhat.rhsa:tst:20200471011 |
comment | spice-gtk-tools is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20121284012 |
|
|
|
|
| rhsa | id | RHSA-2020:0471 | released | 2020-02-11 | severity | Moderate | title | RHSA-2020:0471: spice-gtk security update (Moderate) |
|
| rpms | - libgovirt-0:0.3.4-3.el7
- libgovirt-debuginfo-0:0.3.4-3.el7
- libgovirt-devel-0:0.3.4-3.el7
- spice-glib-0:0.35-4.el7
- spice-glib-devel-0:0.35-4.el7
- spice-gtk-debuginfo-0:0.35-4.el7
- spice-gtk-tools-0:0.35-4.el7
- spice-gtk3-0:0.35-4.el7
- spice-gtk3-devel-0:0.35-4.el7
- spice-gtk3-vala-0:0.35-4.el7
- spice-vdagent-0:0.14.0-18.el7
- spice-vdagent-debuginfo-0:0.14.0-18.el7
- virt-viewer-0:5.0-15.el7
- virt-viewer-debuginfo-0:5.0-15.el7
- spice-glib-0:0.26-8.el6_10.2
- spice-glib-devel-0:0.26-8.el6_10.2
- spice-gtk-0:0.26-8.el6_10.2
- spice-gtk-debuginfo-0:0.26-8.el6_10.2
- spice-gtk-devel-0:0.26-8.el6_10.2
- spice-gtk-python-0:0.26-8.el6_10.2
- spice-gtk-tools-0:0.26-8.el6_10.2
|
|
refmap
via4
|
|
Last major update |
12-02-2023 - 23:31 |
Published |
11-09-2018 - 15:29 |
Last modified |
12-02-2023 - 23:31 |