Ubuntu 16.04 LTS: USN-3014-1 Moderate Spice Security Issues

ubuntu

June 21, 2016

Several security issues were fixed in Spice.

Summary

Several security issues were fixed in Spice.

Software Description:

- spice: SPICE protocol client and server library

Details:

Jing Zhao discovered that the Spice smartcard support incorrectly handled

memory. A remote attacker could use this issue to cause Spice to crash,

resulting in a denial of service, or possibly execute arbitrary code. This

issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)

Frediano Ziglio discovered that Spice incorrectly handled certain primary

surface parameters. A malicious guest operating system could potentially

exploit this issue to escape virtualization. (CVE-2016-2150)

Topics Covered

security advisory denial of service software update remote code execution ubuntu high risk spice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libspice-server1                0.12.6-4ubuntu0.1

Ubuntu 15.10:
  libspice-server1                0.12.5-1.1ubuntu2.1

Ubuntu 14.04 LTS:
  libspice-server1                0.12.4-0nocelt2ubuntu1.3

After a standard system update you need to restart qemu guests to make
all the necessary changes.