Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2016-3066

spice-gtk: hijacks clipboard and sends contents to remote servers

The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Spice-gtk Project
Products
Spice-gtk
CVE-2013-4324

spice-gtk: Insecure calling of polkit via polkit_unix_process_new()

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Spice-gtk Project
Products
Enterprise Linux Spice-gtk
CVE-2017-12194

spice-gtk: Integer overflows causing buffer overflows in spice-client

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.

CVSS 3.0 · 9.8 Critical EPSS 5.2% KEV · Not listed
Vendors
Spice-gtk Project
Products
Spice-gtk