CVE-2017-12194

CRITICAL 9.8CVE-2017-12194 · Published 14/03/2018 · updated 17/06/2026

In short

CVE-2017-12194 is a CRITICAL (CVSS 9.8) vulnerability affecting spice-gtk (spice-gtk project).
Chance of exploitation in the next 30 days (EPSS): 5.2%, higher than 92.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
spice-gtk spice-gtk_project	`≤ 0.34`	No fix yet

Description

A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.

References

securityfocus.com/bid/103413 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
security.gentoo.org/glsa/201811-20
usn.ubuntu.com/3659-1

More vulnerabilities in spice-gtk

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free