CVE-2016-9578

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-770

Affected software

Vendor	Product	Versions
Red Hat	spice	0.13.90

References

http://rhn.redhat.com/errata/RHSA-2017-0253.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0549.htmlThird Party Advisory
http://www.securityfocus.com/bid/96118Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0254Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0552Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9578Issue Tracking, Third Party Advisory
https://www.debian.org/security/2017/dsa-3790Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0253.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0549.htmlThird Party Advisory
http://www.securityfocus.com/bid/96118Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0254Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0552Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9578Issue Tracking, Third Party Advisory
https://www.debian.org/security/2017/dsa-3790Third Party Advisory

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-95797.5A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a buc CVE-2016-95808.8An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.CVE-2016-95818.8An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.CVE-2016-95837.8An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.CVE-2016-95849.1libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.CVE-2016-95855.3Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passe CVE-2016-95868.1curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the pr CVE-2016-95878.1Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. A CVE-2016-95885.5arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of s CVE-2016-95897.5Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow ke CVE-2016-95906.5puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation o CVE-2016-95915.5JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on t