| Package | Affected versions | Patched versions |
|---|---|---|
| spice-xpi | = 2.2 |
Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free