SUSE-SU-2016:1561-1

Details

spice was updated to fix two security issues.

These security issues were fixed:

CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).

Affected Packages

libspice-server1

SUSE Linux Enterprise Desktop 12SUSE Linux Enterprise Server 12SUSE Linux Enterprise Server for SAP Applications 12

Fixed in:

0.12.4-8.9.1

spice

SUSE Linux Enterprise Desktop 12SUSE Linux Enterprise Server 12SUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Software Development Kit 12

Fixed in:

0.12.4-8.9.1

libspice-server-devel

SUSE Linux Enterprise Software Development Kit 12

Fixed in:

0.12.4-8.9.1

References

REPORT

https://bugzilla.suse.com/982385

REPORT

https://bugzilla.suse.com/982386

WEB

https://www.suse.com/security/cve/CVE-2016-0749

WEB

https://www.suse.com/security/cve/CVE-2016-2150

ADVISORY

https://www.suse.com/support/update/announcement/2016/suse-su-20161561-1/