CVE-2018-10873

Current Description

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Basic Data

PublishedAugust 17, 2018
Last ModifiedOctober 09, 2019
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-20
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationSINGLE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score6.5
SeverityMEDIUM
Exploitability Score8.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

CVSS 3 - Version3.0
CVSS 3 - Vector StringCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3 - Attack VectorNETWORK
CVSS 3 - Attack ComplexityLOW
CVSS 3 - Privileges RequiredLOW
CVSS 3 - User InteractionNONE
CVSS 3 - ScopeUNCHANGED
CVSS 3 - Confidentiality ImpactHIGH
CVSS 3 - Integrity ImpactHIGH
CVSS 3 - Availability ImpactHIGH
CVSS 3 - Base Score8.8
CVSS 3 - Base SeverityHIGH
Exploitability Score2.8
Base SeverityHIGH

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSpice ProjectSpice********0.14.1
  • OR - Configuration 2
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSDebianDebian Linux8.0*******
    2.3OSDebianDebian Linux9.0*******
  • OR - Configuration 3
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSCanonicalUbuntu Linux14.04***lts***
    2.3OSCanonicalUbuntu Linux16.04***lts***
    2.3OSCanonicalUbuntu Linux18.04***lts***
  • OR - Configuration 4
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationRedhatVirtualization4.0*******
    2.3ApplicationRedhatVirtualization Host4.0*******
    2.3OSRedhatEnterprise Linux Desktop6.0*******
    2.3OSRedhatEnterprise Linux Desktop7.0*******
    2.3OSRedhatEnterprise Linux Server6.0*******
    2.3OSRedhatEnterprise Linux Server7.0*******
    2.3OSRedhatEnterprise Linux Server Aus7.6*******
    2.3OSRedhatEnterprise Linux Server Eus7.5*******
    2.3OSRedhatEnterprise Linux Server Eus7.6*******
    2.3OSRedhatEnterprise Linux Server Tus7.6*******
    2.3OSRedhatEnterprise Linux Workstation6.0*******
    2.3OSRedhatEnterprise Linux Workstation7.0*******

Vulnerable Software List

VendorProductVersions
Debian Debian Linux 8.0, 9.0
Canonical Ubuntu Linux 14.04, 16.04, 18.04
Redhat Enterprise Linux Workstation 6.0, 7.0
Redhat Virtualization Host 4.0
Redhat Enterprise Linux Desktop 6.0, 7.0
Redhat Enterprise Linux Server Aus 7.6
Redhat Enterprise Linux Server Tus 7.6
Redhat Enterprise Linux Server Eus 7.5, 7.6
Redhat Virtualization 4.0
Redhat Enterprise Linux Server 6.0, 7.0
Spice Project Spice *

References

NameSourceURLTags
105152http://www.securityfocus.com/bid/105152BIDThird Party Advisory VDB Entry
RHSA-2018:2731https://access.redhat.com/errata/RHSA-2018:2731REDHATThird Party Advisory
RHSA-2018:2732https://access.redhat.com/errata/RHSA-2018:2732REDHATThird Party Advisory
RHSA-2018:3470https://access.redhat.com/errata/RHSA-2018:3470REDHATThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10873https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10873CONFIRMIssue Tracking Third Party Advisory
https://gitlab.freedesktop.org/spice/spice-common/commit/bb15d4815ab586b4c4a20f4a565970a44824c42chttps://gitlab.freedesktop.org/spice/spice-common/commit/bb15d4815ab586b4c4a20f4a565970a44824c42cCONFIRMPatch Third Party Advisory
[debian-lts-announce] 20180831 [SECURITY] [DLA 1488-1] spice security updatehttps://lists.debian.org/debian-lts-announce/2018/08/msg00035.htmlMLISTMailing List Third Party Advisory
[debian-lts-announce] 20180831 [SECURITY] [DLA 1486-1] spice security updatehttps://lists.debian.org/debian-lts-announce/2018/08/msg00037.htmlMLISTMailing List Third Party Advisory
[debian-lts-announce] 20180831 [SECURITY] [DLA 1489-1] spice-gtk security updatehttps://lists.debian.org/debian-lts-announce/2018/08/msg00038.htmlMLISTMailing List Third Party Advisory
USN-3751-1https://usn.ubuntu.com/3751-1/UBUNTUThird Party Advisory
DSA-4319https://www.debian.org/security/2018/dsa-4319DEBIANThird Party Advisory