Ubuntu 18.10: 3870-1 Moderate Spice Denial of Service Issue Update

ubuntu

January 28, 2019

Spice could be made to crash or run programs if it received specially crafted network traffic.

Summary

Spice could be made to crash or run programs if it received specially

crafted network traffic.

Software Description:

- spice: SPICE protocol client and server library

Details:

Christophe Fergeau discovered that Spice incorrectly handled memory. A

remote attacker could use this to cause Spice to crash, resulting in a

denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory denial of service Ubuntu remote execution software issue spice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  libspice-server1                0.14.0-1ubuntu4.2

Ubuntu 18.04 LTS:
  libspice-server1                0.14.0-1ubuntu2.4

Ubuntu 16.04 LTS:
  libspice-server1                0.12.6-4ubuntu0.4

Ubuntu 14.04 LTS:
  libspice-server1                0.12.4-0nocelt2ubuntu1.8

After a standard system update you need to restart qemu guests to make all
the necessary changes.