CVE-2013-4130

CWE-3999 documents8 sources
Severity
5.0MEDIUM
EPSS
1.1%
top 21.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Spice Project SpiceCanonical Ubuntu Linux
Timeline
PublishedAug 20
Latest updateMay 17

Description

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debianspice< 0.12.4-0nocelt1+3
▶NVDspice_project/spice0.12.3+23

Also affects: Ubuntu Linux 13.04

Patches

Patch: cgit.freedesktop.org ↗Patch: cgit.freedesktop.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-3mmx-gfx4-6h3r: The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel↗2022-05-17
▶
CVEList
CVE-2013-4130: The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel↗2013-08-20
▶
OSV
CVE-2013-4130: The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel↗2013-08-20
▶

📋Vendor Advisories

3
Ubuntu
SPICE vulnerability↗2013-08-14
▶
Red Hat
spice: unsafe clients ring access abort↗2013-07-05
▶
Debian
CVE-2013-4130: spice - The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg funct...↗2013
▶

💬Community

2
Bugzilla
spice: CVE-2013-4130 spice: unsafe clients ring access abort [fedora-all]↗2013-07-16
▶
Bugzilla
CVE-2013-4130 spice: unsafe clients ring access abort↗2013-07-15
▶