Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 580
Alerts This Week
Warning Icon 1 580

SUSE: 2021:2766-1 Moderate: Spice-vdagent Denial of Service Fix

suse
Calendar Grey August 17, 2021
Dist Suse Esm H88
The new spice-vdagent release resolves multiple vulnerabilities, including denial of service and memory corruption. For detailed information, please refer to the advisory
An update that fixes four vulnerabilities is now available

Summary

This update for spice-vdagent fixes the following issues: - CVE-2020-25650: memory DoS via arbitrary entries in `active_xfers` hash table (bsc#1177780) - CVE-2020-25651: possible file transfer DoS and information leak via `active_xfers` hash map (bsc#1177781) - CVE-2020-25652: possibility to exhaust file descriptors in `vdagentd` (bsc#1177782) - CVE-2020-25653: UNIX domain socket peer PID retrieved via `SO_PEERCRED` is subject to race condition (bsc#1177783) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-2766=1 Package List:

Topics%20covered

Topics Covered

security advisory moderate denial of service SUSE Linux Enterprise spice-vdagent

References

#1177780 #1177781 #1177782 #1177783

Cross- CVE-2020-25650 CVE-2020-25651 CVE-2020-25652

CVE-2020-25653

CVSS scores:

CVE-2020-25650 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2020-25650 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2020-25651 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

CVE-2020-25651 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H

CVE-2020-25652 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2020-25652 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2020-25653 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Server 12-SP5

https://www.suse.com/security/cve/CVE-2020-25650.html

Announcement ID: SUSE-SU-2021:2766-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service SUSE Linux Enterprise spice-vdagent

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.