[ GLSA 201811-20 ] spice-gtk

[GLSA]

Gentoo Linux Security Advisory

Title: spice-gtk: Remote code execution (GLSA 201811-20)
Severity: normal
Exploitable: local, remote
Date: 2018-11-27
Bug(s): #650878
ID: 201811-20

Synopsis

A vulnerability in spice-gtk could allow an attacker to remotely
execute arbitrary code.


Background

spice-gtk is a set of GObject and Gtk objects for connecting to Spice
servers and a client GUI.


Affected Packages

Package: net-misc/spice-gtk
Vulnerable: < 0.34
Unaffected: >= 0.34
Architectures: All supported architectures


Description

A vulnerability was found in spice-gtk client due to the incorrect use
of integer types and missing overflow checks.


Impact

An attacker, by enticing the user to join a malicious server, could
remotely execute arbitrary code or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All spice-gtk users should upgrade to the latest version: