CVE-2019-3813

HIGH7.5EPSS 0.26%

spice - security update

Published: 2/4/2019Modified: 4/28/2026

Description

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.

Affected packages (4)

Alpine/spicefrom 0, < 0.14.1-r4
Debian/spicefrom 0, < 0.14.0-1.3
Debian/spicefrom 0, < 0.12.5-1+deb8u7
Debian/spicefrom 0, < 0.12.8-2.1+deb9u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-3813
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-3813