From: Marc Deslauriers Reply-To: Ubuntu Security To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <576938FE.6020208@canonical.com> Subject: [USN-3014-1] Spice vulnerabilities ============================================================================ Ubuntu Security Notice USN-3014-1 June 21, 2016 spice vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Spice. Software Description: - spice: SPICE protocol client and server library Details: Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749) Frediano Ziglio discovered that Spice incorrectly handled certain primary surface parameters. A malicious guest operating system could potentially exploit this issue to escape virtualization. (CVE-2016-2150) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libspice-server1 0.12.6-4ubuntu0.1 Ubuntu 15.10: libspice-server1 0.12.5-1.1ubuntu2.1 Ubuntu 14.04 LTS: libspice-server1 0.12.4-0nocelt2ubuntu1.3 After a standard system update you need to restart qemu guests to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3014-1 CVE-2016-0749, CVE-2016-2150 Package Information: https://launchpad.net/ubuntu/+source/spice/0.12.6-4ubuntu0.1 https://launchpad.net/ubuntu/+source/spice/0.12.5-1.1ubuntu2.1 https://launchpad.net/ubuntu/+source/spice/0.12.4-0nocelt2ubuntu1.3