-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3769
spice-gtk security update
2 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: spice-gtk
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14355
Reference: ESB-2020.3757
ESB-2020.3735
ESB-2020.3503
ESB-2020.3456.2
ESB-2020.3455
Original Bulletin:
https://www.debian.org/lts/security/2020/dla-2428
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -----------------------------------------------------------------------
Debian LTS Advisory DLA-2428-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
November 01, 2020 https://wiki.debian.org/LTS
- - -----------------------------------------------------------------------
Package : spice-gtk
Version : 0.33-3.3+deb9u2
CVE ID : CVE-2020-14355
Debian Bug : 971751
Multiple buffer overflow vulnerabilities were found in the QUIC
image decoding process of the SPICE remote display system.
Both the SPICE client (spice-gtk) and server are affected by
these flaws. These flaws allow a malicious client or server to
send specially crafted messages that, when processed by the
QUIC image compression algorithm, result in a process crash or
potential code execution.
For Debian 9 stretch, this problem has been fixed in version
0.33-3.3+deb9u2.
We recommend that you upgrade your spice-gtk packages.
For the detailed security status of spice-gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/spice-gtk
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl+e62wACgkQgj6WdgbD
S5ZJZxAAtCwyFoGQ8ggJN50y8kWOPSKlPwJtPjjxwOV7CPsaWX4PlQ8TJiKX85u3
r5I+CwTID8De/pmLVRlf8fHslz0TvqPwZkdiDybgyiIfWPd0l78MxZEZmH+HheP3
jh6A9PF1kewp8i/s957X9QVlDLnkpPfBAIZfnzLhqWB873RzYXIXlcraHERTDOKo
JC+IaCmpXebNpSanXEKstOndwqjA8m5DmoOaUMWM8eeQPi9QoYh40z6JyBZDAAXZ
pNVqXN0GMDpfGkTQ8qtVCebtD/hkOruNUQO1qJSPCxfvUygzC7RrAfMBZiu3cuQA
yewjoaE3UyljCGYHJfb8aGv3sueNbQRwa9sOATPvUCAvo9vAGE9ezFdDk8w/qYyW
0XnKGL6fCKdfVARWSsEjNw/9Ljf4AK/iUS2kt/5OeYqH5e5I6IBcOxMIBASC09G3
94x6UfTzqKY4Z5mhRjr60J1r8glmDzRRkSf3f28USs494Uv4Mi5QaymTzJO3qKVy
Hu5fVswi8HBKzbeyKVi1wrp/xgurWH56mgs9M0uc3gfgELSOToKeT6ag97di090I
t1gJ49PJ4kPzAsMqf4f03erfmFtiz7Rn+FHSKngOXlBnE2bWMenUyMsy4elutsiW
BHsgRbFjr6hRx5x/orIrg6pgeeTJyF+HnmbwuxqXKxwKe45La4A=
=xm0z
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX59kb+NLKJtyKPYoAQgYthAAjj5hCsjjQTLmHtq35zVgZl4hA+sBzaHf
A/4C4l+bQs/1GTyVXB0eur48fkKZXAp1tFtSX3Zia1QOKDEaKjhYEK9s0ySb1a/X
X7nVyE//BcZ7qc+aKqn/6V4uJoXy39ALVaioNXM2v9/2gQl1IxueGFs+NzIurW/g
PVRVp0znaSSWAPYyyVaO07CaLQ+vtsYrd8JqiAnZ8mO7CD4aJcpLr/BVjJtzMT1z
5HZJAQIwYEnWPFbqNk1rk88Qp+y+jl6sZMmYoOnlMxbvjDBNUgcaB1ibiBvQa1pX
ZNLibbluPf//P1pzcmRvSVi0Xtfe5BUmu4Fcg7Qsye/FucNvz8A+R3mcp5n4Irbe
ZWzPUJTYDDybrxoQ5l4AyWwkZfshHW5ml/AJcvrtvQAP/8qPCZaoA5zfXo2Tsp14
BYZ7cldmnHiZuHjpdvExYCQO4uKzemX3hlexBDxQO2tO1tVEJfSyBfsaGrFImZLh
kStLaE+EgzQBhjjbZW5y4v6Cjf3tmy/YBb86oYh6oy9eo4hDcimU5aCXs+ABz/RN
00qwVTm4R7CgKtrFqW1BHBIinUDWwRrpakqoyvNGkYaUCoSFp81pbVqbKXTKTMTS
gAcs35HZSgzGUSkHMdkObZ7xQigThqqvXYoxCflumhkOMlwourPafBof6NB3n3rQ
LDrevG3XppM=
=xfyK
-----END PGP SIGNATURE-----
The post ESB-2020.3769 – [Debian] spice-gtk: Multiple vulnerabilities appeared first on Malware Devil.
https://malwaredevil.com/2020/11/02/esb-2020-3769-debian-spice-gtk-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-3769-debian-spice-gtk-multiple-vulnerabilities
No comments:
Post a Comment