A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - spice-gtk:  Integer overflows causing buffer overflows in spice-client (CVE-2017-12194)

  - The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
    (CVE-2016-3066)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - spice-gtk:  Integer overflows causing buffer overflows in spice-client (CVE-2017-12194)

  - The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
    (CVE-2016-3066)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the spice-gtk packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way spice-client processed     certain messages sent from the server. An attacker,     having control of malicious spice-server, could use     this flaw to crash the client or execute arbitrary code     with permissions of the user running the     client.(CVE-2017-12194)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spice-gtk packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Multiple buffer overflow vulnerabilities were found in     the QUIC image decoding process of the SPICE remote     display system, before spice-0.14.2-1. Both the SPICE     client (spice-gtk) and server are affected by these     flaws. These flaws allow a malicious client or server     to send specially crafted messages that, when processed     by the QUIC image compression algorithm, result in a     process crash or potential code     execution.(CVE-2020-14355)

  - A flaw was found in the way spice-client processed     certain messages sent from the server. An attacker,     having control of malicious spice-server, could use     this flaw to crash the client or execute arbitrary code     with permissions of the user running the client.
    spice-gtk versions through 0.34 are believed to be     vulnerable.(CVE-2017-12194)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spice-gtk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple buffer overflow vulnerabilities were found in     the QUIC image decoding process of the SPICE remote     display system, before spice-0.14.2-1. Both the SPICE     client (spice-gtk) and server are affected by these     flaws. These flaws allow a malicious client or server     to send specially crafted messages that, when processed     by the QUIC image compression algorithm, result in a     process crash or potential code     execution.(CVE-2020-14355)

  - A flaw was found in the way spice-client processed     certain messages sent from the server. An attacker,     having control of malicious spice-server, could use     this flaw to crash the client or execute arbitrary code     with permissions of the user running the client.
    spice-gtk versions through 0.34 are believed to be     vulnerable.(CVE-2017-12194)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spice-gtk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way spice-client processed     certain messages sent from the server. An attacker,     having control of malicious spice-server, could use     this flaw to crash the client or execute arbitrary code     with permissions of the user running the client.
    spice-gtk versions through 0.34 are believed to be     vulnerable.(CVE-2017-12194)

  - Multiple buffer overflow vulnerabilities were found in     the QUIC image decoding process of the SPICE remote     display system, before spice-0.14.2-1. Both the SPICE     client (spice-gtk) and server are affected by these     flaws. These flaws allow a malicious client or server     to send specially crafted messages that, when processed     by the QUIC image compression algorithm, result in a     process crash or potential code     execution.(CVE-2020-14355)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-20 (spice-gtk: Remote code execution)

    A vulnerability was found in spice-gtk client due to the incorrect use       of integer types and missing overflow checks.
  Impact :

    An attacker, by enticing the user to join a malicious server, could       remotely execute arbitrary code or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the spice-gtk packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way spice-client processed     certain messages sent from the server. An attacker,     having control of malicious spice-server, could use     this flaw to crash the client or execute arbitrary code     with permissions of the user running the     client.(CVE-2017-12194)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3659-1 advisory.

    Frediano Ziglio discovered that Spice incorrectly handled certain client messages. An attacker could     possibly use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for spice-gtk fixes the following issues :

  - CVE-2017-12194: A flaw was found in the way spice-client     processed certain messages sent from the server. An     attacker, having control of malicious spice-server,     could use this flaw to crash the client or execute     arbitrary code with permissions of the user running the     client. spice-gtk versions through 0.34 are believed to     be vulnerable. (bsc#1085415)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for spice-gtk fixes the following issues :

  - CVE-2017-12194: A flaw was found in the way spice-client     processed certain messages sent from the server. An     attacker, having control of malicious spice-server,     could use this flaw to crash the client or execute     arbitrary code with permissions of the user running the     client. spice-gtk versions through 0.34 are believed to     be vulnerable. (bsc#1085415)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198932	RHEL 6 : spice-gtk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198900	RHEL 7 : spice-gtk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
151334	EulerOS Virtualization for ARM 64 3.0.2.0 : spice-gtk (EulerOS-SA-2021-2099)	Nessus	Huawei Local Security Checks	critical
147119	EulerOS Virtualization 3.0.6.6 : spice-gtk (EulerOS-SA-2021-1519)	Nessus	Huawei Local Security Checks	critical
146132	EulerOS 2.0 SP5 : spice-gtk (EulerOS-SA-2021-1233)	Nessus	Huawei Local Security Checks	critical
145110	EulerOS 2.0 SP3 : spice-gtk (EulerOS-SA-2021-1122)	Nessus	Huawei Local Security Checks	critical
119165	GLSA-201811-20 : spice-gtk: Remote code execution	Nessus	Gentoo Local Security Checks	critical
110154	EulerOS 2.0 SP2 : spice-gtk (EulerOS-SA-2018-1150)	Nessus	Huawei Local Security Checks	critical
110153	EulerOS 2.0 SP1 : spice-gtk (EulerOS-SA-2018-1149)	Nessus	Huawei Local Security Checks	critical
110124	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Spice vulnerability (USN-3659-1)	Nessus	Ubuntu Local Security Checks	critical
108934	openSUSE Security Update : spice-gtk (openSUSE-2018-342)	Nessus	SuSE Local Security Checks	critical
108874	SUSE SLED12 / SLES12 Security Update : spice-gtk (SUSE-SU-2018:0877-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-12194

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical