CVE-2017-12194 Memory corruption in spice-gtk
A malicious SPICE server can crash the client or execute arbitrary code via improper message processing in spice-gtk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12194?
CVE-2017-12194 is a critical memory corruption vulnerability in freedesktop.org spice-gtk, published on 14 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.
Which versions are affected by CVE-2017-12194?
It affects 1 product.
Linux distribution packages (4)
spice-gtk SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 0.33-3.3.2 |
spice-gtk SUSE:Linux Enterprise Server 12 SP3 | All versions | 0.33-3.3.2 |
spice-gtk SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 0.33-3.3.2 |
spice-gtk SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 0.33-3.3.2 |
Products include Spice-Gtk Project Spice-Gtk.
How do I fix CVE-2017-12194?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-12194 being exploited?
There is no known exploitation of CVE-2017-12194 in the wild and no public exploit code.
Other vulnerabilities in freedesktop.org spice-gtk
Sources
Also known as DEBIAN-CVE-2017-12194, GHSA-r5rv-8pm6-w5ch, SUSE-SU-2018:0877-1, UBUNTU-CVE-2017-12194, USN-3659-1.