Denial of Service Vulnerability in spice
Summary
DSA-2839-1: spice - denial of service. Affects spice versions < 0.11.0-1+deb7u1. Fixed in 0.11.0-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Spice is a SPICE protocol client and server library. It provides a framework for remote access to virtual machines. The SPICE protocol allows users to interact with virtualized desktops or applications running on a remote machine. The spice package in Debian 7 (wheezy) is affected by a denial of service vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2013-4130, occurs due to the incorrect handling of certain network errors in the SPICE protocol. An attacker who can initiate a SPICE connection to an application acting as a SPICE server can exploit this flaw to crash the application. Another vulnerability, CVE-2013-4282, is caused by the incorrect handling of long passwords in SPICE tickets, leading to a similar denial of service condition. These vulnerabilities can be exploited remotely.
How To Fix
Minimum fixed version
0.11.0-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade spiceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The spice package in Debian 7 (wheezy) is affected by denial of service vulnerabilities. Upgrading to the recommended versions will mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for spice →
FAQ
These vulnerabilities allow remote attackers to crash applications acting as SPICE servers, resulting in denial of service.
No, these vulnerabilities require the ability to initiate a SPICE connection to the target application.
There is no information available regarding active exploitation of these vulnerabilities.
The CVSS score for these vulnerabilities has not been provided in the vulnerability details.
The provided vulnerability details include the necessary information about these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for spice.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
