CVE-2018-10873 HIGH

CVE-2018-10873

Vendor [Unknown]
Product spice:
Weakness CWE-119
Published August 17, 2018
Last update August 5, 2024

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

What the vulnerability does

01Description

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Key dates

02Disclosure timeline

August 17, 2018 CVE published
August 5, 2024 Record updated