This update for spice fixes the following issues :

Security issue fixed :

  - CVE-2019-3813: Fixed a out-of-bounds read in the     memslot_get_virt function that could lead to     denial-of-service or code-execution (bsc#1122706).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

According to the version of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - spice: Off-by-one error in array access in     spice/server/memslot.c (CVE-2019-3813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Christophe Fergeau (Red Hat).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christophe Fergeau discovered an out-of-bounds read vulnerability in spice, a SPICE protocol client and server library, which might result in denial of service (spice server crash), or possibly, execution of arbitrary code.

For Debian 8 'Jessie', this problem has been fixed in version 0.12.5-1+deb8u7.

We recommend that you upgrade your spice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - spice: Off-by-one error in array access in     spice/server/memslot.c (CVE-2019-3813)

This update for spice fixes the following issues :

Security issue fixed :

CVE-2019-3813: Fixed a out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spice fixes the following issues :

Security issue fixed :

CVE-2019-3813: Fixed an out-of-bounds read in the memslot_get_virt function that could lead to denial-of-service or code-execution (bsc#1122706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2019-3813

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0457 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.2), redhat-virtualization-host (4.2). (BZ#1678629, BZ#1679414)

    Security Fix(es):

    * spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)

    * systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

    * vdsm: privilege escalation to root via systemd_run (CVE-2019-3831)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122223	openSUSE Security Update : spice (openSUSE-2019-176)	Nessus	SuSE Local Security Checks	2019/2/15	2024/6/20	high
123601	EulerOS 2.0 SP2 : spice (EulerOS-SA-2019-1127)	Nessus	Huawei Local Security Checks	2019/4/2	2024/6/6	high
144523	Virtuozzo 6 : spice-server / spice-server-devel (VZLSA-2019-0232)	Nessus	Virtuozzo Local Security Checks	2020/12/22	2024/1/31	high
121481	Debian DLA-1649-1 : spice security update	Nessus	Debian Local Security Checks	2019/1/31	2024/6/25	high
121535	Scientific Linux Security Update : spice-server on SL6.x x86_64 (20190131)	Nessus	Scientific Linux Local Security Checks	2019/2/1	2024/6/25	high
121613	SUSE SLES12 Security Update : spice (SUSE-SU-2019:0231-1)	Nessus	SuSE Local Security Checks	2019/2/6	2024/6/24	high
122051	SUSE SLES11 Security Update : spice (SUSE-SU-2019:13943-1)	Nessus	SuSE Local Security Checks	2019/2/8	2024/6/21	high
122079	Fedora 29 : spice (2019-a095a16c47)	Nessus	Fedora Local Security Checks	2019/2/11	2024/6/21	high
122737	RHEL 7 : redhat-virtualization-host (RHSA-2019:0457)	Nessus	Red Hat Local Security Checks	2019/3/11	2024/11/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

high