Packages
- spice - SPICE protocol client and server library
Details
Jing Zhao discovered that the Spice smartcard support incorrectly handled
memory. A remote attacker could use this issue to cause Spice to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)
Frediano Ziglio discovered that Spice incorrectly handled certain primary
surface parameters. A malicious guest operating system could potentially
exploit this issue to escape virtualization. (CVE-2016-2150)
Jing Zhao discovered that the Spice smartcard support incorrectly handled
memory. A remote attacker could use this issue to cause Spice to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)
Frediano Ziglio discovered that Spice incorrectly handled certain primary
surface parameters. A malicious guest operating system could potentially
exploit this issue to escape virtualization. (CVE-2016-2150)
Update instructions
After a standard system update you need to restart qemu guests to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 16.04 xenial | libspice-server1 – 0.12.6-4ubuntu0.1 | ||
| 15.10 wily | libspice-server1 – 0.12.5-1.1ubuntu2.1 | ||
| 14.04 trusty | libspice-server1 – 0.12.4-0nocelt2ubuntu1.3 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.