Ubuntu: USN-3202-1 Moderate: Spice Denial Of Service Risk

ubuntu

February 20, 2017

Spice could be made to crash or run programs if it received specially crafted network traffic.

Summary

Spice could be made to crash or run programs if it received specially

crafted network traffic.

Software Description:

- spice: SPICE protocol client and server library

Details:

Frediano Ziglio discovered that Spice incorrectly handled certain client

messages. A remote attacker could use this issue to cause Spice to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory denial of service software update Ubuntu issue report spice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libspice-server1                0.12.8-1ubuntu0.1

Ubuntu 16.04 LTS:
  libspice-server1                0.12.6-4ubuntu0.2

Ubuntu 14.04 LTS:
  libspice-server1                0.12.4-0nocelt2ubuntu1.4

After a standard system update you need to restart qemu guests to make
all the necessary changes.