CVE-2016-9577

moderate-risk
Published 2018-07-27

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.

Do I need to act?

~
3.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / HIGH complexity

Affected Products (13)

Spice

Affected Vendors

Debian Redhat Spice Project

References (14)

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0253.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0549.html
Third Party Advisory http://www.securityfocus.com/bid/96040
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0254
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0552
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9577
Third Party Advisory https://www.debian.org/security/2017/dsa-3790
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0253.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0549.html
Third Party Advisory http://www.securityfocus.com/bid/96040
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0254
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0552
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9577
Third Party Advisory https://www.debian.org/security/2017/dsa-3790
46
/ 100
moderate-risk
Severity 22/34 · High
Exploitability 7/34 · Low
Exposure 17/34 · Moderate