Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

SPICE guest can read/write host memory via QXL

CVE-2015-5261 · published 10 years ago
Summary

Linux systems running SPICE versions earlier than 0.12.6 (including Ubuntu and Red Hat Enterprise Linux editions) are vulnerable. A user inside a virtual machine could access or modify the host computer's memory, potentially exposing data or gaining control. Update SPICE to version 0.12.6 or later, or apply the security patches provided by your Linux distribution.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
canonical ubuntu_linux 14.04
15.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
redhat enterprise_linux_desktop 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 6.7.z
7.1
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7.z:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node_eus 7.1
cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*
debian debian_linux 7.0
8.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
spice_project spice <= 0.12.5
cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published7 Jun 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-5261 · NVD
Track software like this
Free during beta