[SECURITY] [DSA 3354-1] spice security update

Fabricante: Debian
Fecha: 08/09/2015
Identificador: DSA 3354-1
[SECURITY] [DSA 3354-1] spice security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3354-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso September 08, 2015 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : spice CVE ID : CVE-2015-3247 Debian Bug : 797976 Frediano Ziglio of Red Hat discovered a race condition flaw in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A malicious user in a guest can take advantage of this flaw to cause a denial of service (QEMU process crash) or, potentially execute arbitrary code on the host with the privileges of the hosting QEMU process. For the stable distribution (jessie), this problem has been fixed in version 0.12.5-1+deb8u1. For the unstable distribution (sid), this problem has been fixed in version 0.12.5-1.2. We recommend that you upgrade your spice packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJV7xxXAAoJEAVMuPMTQ89Ek28P/0DMZLCpmYys8q9u51DBwxe/ 4D83kcAkCcHkXs3sXf6QLtdOEbEaYwJtewMVglKC+DtWVVfadl69MGag0fvid6yu 4W6dpGMRvITyyFEFwg8w/FnLP15rk6CwI/xZylqXOvEmg/VwxFzwZFEwVkFpNZwu jzUzgalklemPCwQ11EMbDOJZ9dj/t4G9abrB9cUxZ42mlXFXfnOK4d84RC/sOmNo OLSPCozxwZ2Gvf0hzZtnW+YL3rsRWbMzurhG8NuEh6TT/M9Az/sYDZYwJBfVyvm5 zXXVHRMk4YzrXXFtmz39JUkehsROAeNkZRPWs1dNSsqAp21YzpM+gyBem/fA35Fl a9FgxwUNeff7MZCpMYy8/g4Pk0mVOZ3HVSj9/3g8FSJXqnbdCEkMpO47cqyAtSC+ 7yynKo51PvlIMmXCRdMf//43IETIQDDrdykj0PCNOA7xbZxleJeLM9HhrihL8P3n 39RHFsk+RiPl9KCsNTZsA0CxgomizwQsHw1VonVtb4zl7Kgu1LNS8/lIS18fsuG3 FmQ5OJR7mdRtpCXaDE3D6f1JMHhhuT9yFpxyyRBpEIEYvl0Xgp1DwIPA9Y0FLGdw 84I9BAqFNU0jHhdr5EEchD67EwDnUvktMbo+XjV74i2Ke6q1Vss2XypP+Q9cyXiH hlCWKiI0pnrTey9hLHO/ =yi4J -----END PGP SIGNATURE-----