Joined: 12 May 2004
|Posted: Tue Nov 27, 2018 5:26 am Post subject: [ GLSA 201811-20 ] spice-gtk
|Gentoo Linux Security Advisory
Title: spice-gtk: Remote code execution (GLSA 201811-20)
Exploitable: local, remote
A vulnerability in spice-gtk could allow an attacker to remotely
execute arbitrary code.
spice-gtk is a set of GObject and Gtk objects for connecting to Spice
servers and a client GUI.
Vulnerable: < 0.34
Unaffected: >= 0.34
Architectures: All supported architectures
A vulnerability was found in spice-gtk client due to the incorrect use
of integer types and missing overflow checks.
An attacker, by enticing the user to join a malicious server, could
remotely execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All spice-gtk users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/spice-gtk-0.34"