CVE-2016-9578: A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling

High severity · published Jul 27, 2018

CVE-2016-9578

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling

7.5

CVSS

2.5%

EPSS

On KEV

Description

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 84% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

8.0 · source: NVD

Enterprise Linux Desktop · Redhat

6.0; 7.0 · source: NVD

Enterprise Linux Server · Redhat

6.0; 7.0 · source: NVD

Enterprise Linux Server Aus · Redhat

7.3; 7.4 · source: NVD

Enterprise Linux Server Eus · Redhat

7.3; 7.4; 7.5 · source: NVD

Enterprise Linux Workstation · Redhat

6.0; 7.0 · source: NVD

Spice · Spice Project

before 0.13.90 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-9578

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-9578

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0253.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0549.html

Third Party Advisory

http://www.securityfocus.com/bid/96118

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:0254

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:0552

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9578