VulnerabilityModified

CVE-2015-5261

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

HIGH 7.1EPSS 0.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

CVSS 3.0: 7.1 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.49% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: canonical/ubuntu linux · redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux server · redhat/enterprise linux server eus · redhat/enterprise linux workstation · redhat/enterprise linux hpc node eus · debian/debian linux · spice project/spice
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.