-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3768
spice security update
2 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: spice
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14355
Reference: ESB-2020.3757
ESB-2020.3735
ESB-2020.3503
ESB-2020.3456.2
ESB-2020.3455
Original Bulletin:
https://www.debian.org/lts/security/2020/dla-2427
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -----------------------------------------------------------------------
Debian LTS Advisory DLA-2427-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
November 01, 2020 https://wiki.debian.org/LTS
- - -----------------------------------------------------------------------
Package : spice
Version : 0.12.8-2.1+deb9u4
CVE ID : CVE-2020-14355
Debian Bug : 971750
Multiple buffer overflow vulnerabilities were found in the QUIC
image decoding process of the SPICE remote display system,
before spice-0.14.2-1.
Both the SPICE client (spice-gtk) and server are affected by
these flaws. These flaws allow a malicious client or server to
send specially crafted messages that, when processed by the
QUIC image compression algorithm, result in a process crash
or potential code execution.
For Debian 9 stretch, this problem has been fixed in version
0.12.8-2.1+deb9u4.
We recommend that you upgrade your spice packages.
For the detailed security status of spice please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/spice
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl+e6tcACgkQgj6WdgbD
S5bonBAAmDo9gwtOqme9sEjMJz/9i31Phb6JPDKhz2v2hgX0/B3Catc+Ds/BuLIJ
kF2pkS4fktI/xZhKor4EyUHQXqqRoybRqIiW/DUeSEOIFqQYmtC2ThM8vDDgX1P0
i89eQh0GYs86k9ef115WB2U/qyBJfUj8VFCnbAy/U0hov6P1yWxA3EgQ3K55l4gq
wzWBUUJCFO93UbVZvlbvgXMdy4V5ji8eqhI2YS4q6Y+ihpIBLgZmfjSt+dBMn4Ki
rAYj7j0eJHxpZ/sHz0OqW416A8K02L6j9QHwdACq2Q3I5ouGL/DjAJeLNAGrPgXE
6+4jIpzIMu/bGZx9jMmJFRTvhsGRFnd5eP1VCeyexBSJY1NcHDDirt4fgXd5VH7y
HK5c+a+EAR6g093QCTtOJge8sFXUscZpLJZamaWgAbhjTVWRgP4Rau76u6egjFIq
NVuVkfdpbFLhApAOt1Bp1p1VM1wsEY7eeHzwb3lR2NZJ19hZK9KEDCgLwZxTe4tZ
gR6qUEs8XxyGEdgsB/YwAWIUuXIbJOXGp9KKpn6mueAxMcZwhFW5ZGHIsFZmJ+45
tz05jkhtM1C/SyyTWEQJU+PgHKAc8XkQ1LO4uA81htIrtvJRcwH4C5AdDhJJgIFB
oz+YXR2xiCwxP02h8rvX72MFoRxVP1QHvEibWThtlhfccK/xz74=
=Guf4
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX59kIuNLKJtyKPYoAQhGDA//eQGOpFGYg8rDeHsuQFC1alcRs4pGU/3a
q1qMwg+kXXNA33t2Rzw7IjuGDPEyE5Ew49OzuwNl1m4U9xYSgzRsRT+n9ZoWBADJ
LCWpAgtIP8kq26xDPLRpPnBfaD/1nASAfjkxX4Fel1qvqD6q2c9vpMiZi3/ywEjI
zw6FdUCFCXc5jRJnjf75vdY3D3VRWz9VOcCnO5JMnk7nl5P1Wj45i2OxUOeYgCd5
en14NaB2ApjTWR+cS+FIb+iJGm21i4fqvMUITac0lQYtBHEZK5XXtYAOQ5isogDo
OvlFcJNMTPFpkvLkxpqMeTdx/eGv10oi4iTwqBV9qMwiz6ucX1tfRUoh+yaJnJo6
lYyUDM703EkVY3kMPuBXCClVB0zbt7saSHgTZQVMmfzH4YPgWGIRgLHgwdCc47q0
TjBWscYI5nog22smrK6hMBTdyjoDjz8RTju0y4RiVS5wbwcvIaOYb+6OP46NYMIm
ZTgLCEyT/mOo2hJeLi4hvqQNs1PbU5q0xQefgWcSU7UK3E34COEhzwTU11mnak/B
kc0QMubwdnPJ1h6oa9AtxrRTqNp1a7879tGF6ccSOI+ZsiMl91aZn6pObJ8j4ppl
W9JJOrlyUCZ1tUjInb0hLmANzU7JTpZeLCQ6OMOIJ5SuJFaGEDetAiX3nReaJg0R
8/N154lqPG8=
=gxDI
-----END PGP SIGNATURE-----
The post ESB-2020.3768 – [Debian] spice: Multiple vulnerabilities appeared first on Malware Devil.
https://malwaredevil.com/2020/11/02/esb-2020-3768-debian-spice-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-3768-debian-spice-multiple-vulnerabilities
No comments:
Post a Comment