Synopsis

Important: spice-server security update

Type/Severity

Security Advisory: Important

Topic

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es):

• spice: Possible buffer overflow via invalid monitor configurations (CVE-2017-7506)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Frediano Ziglio (Red Hat).

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All applications using SPICE (most notably all QEMU-KVM instances using the SPICE console) must be restarted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

• BZ - 1452606 - CVE-2017-7506 spice: Possible buffer overflow via invalid monitor configurations

CVEs

• CVE-2017-7506

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 6

SRPM
spice-server-0.12.4-16.el6_10.2.src.rpm	SHA-256: 5edd15dc8eb2378857f1ad8cd26eea59249d00f11223800d0cc01885bc22ec80
x86_64
spice-server-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e0fd86a86a062b98f0ba706dcb8bb4571357863bfd024989b46d12afa5611205
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-devel-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e347c52625c64c82bbea3d78a2c20d96b4eb325b6afb6084422fcd69ef7108d1

Red Hat Enterprise Linux Workstation 6

SRPM
spice-server-0.12.4-16.el6_10.2.src.rpm	SHA-256: 5edd15dc8eb2378857f1ad8cd26eea59249d00f11223800d0cc01885bc22ec80
x86_64
spice-server-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e0fd86a86a062b98f0ba706dcb8bb4571357863bfd024989b46d12afa5611205
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-devel-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e347c52625c64c82bbea3d78a2c20d96b4eb325b6afb6084422fcd69ef7108d1

Red Hat Enterprise Linux Desktop 6

SRPM
spice-server-0.12.4-16.el6_10.2.src.rpm	SHA-256: 5edd15dc8eb2378857f1ad8cd26eea59249d00f11223800d0cc01885bc22ec80
x86_64
spice-server-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e0fd86a86a062b98f0ba706dcb8bb4571357863bfd024989b46d12afa5611205
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-devel-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e347c52625c64c82bbea3d78a2c20d96b4eb325b6afb6084422fcd69ef7108d1

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
spice-server-0.12.4-16.el6_10.2.src.rpm	SHA-256: 5edd15dc8eb2378857f1ad8cd26eea59249d00f11223800d0cc01885bc22ec80
x86_64
spice-server-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e0fd86a86a062b98f0ba706dcb8bb4571357863bfd024989b46d12afa5611205
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-debuginfo-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: 2ffd8d7b39d7b92341d25562bc7e5bb88d63759359dda040312488cd78bb22c5
spice-server-devel-0.12.4-16.el6_10.2.x86_64.rpm	SHA-256: e347c52625c64c82bbea3d78a2c20d96b4eb325b6afb6084422fcd69ef7108d1