High severity7.1NVD Advisory· Published Jun 7, 2016· Updated Jun 17, 2026
CVE-2015-5261
CVE-2015-5261
Description
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
29cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*range: <=0.12.5
- (no CPE)range: <0.12.6
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 1 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7.z:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7.z:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- osv-coords12 versionspkg:rpm/opensuse/spice&distro=openSUSE%20Tumbleweedpkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 0.12.8-2.1+ 11 more
- (no CPE)range: < 0.12.8-2.1
- (no CPE)range: < 0.12.4-8.5.1
- (no CPE)range: < 0.12.5-4.1
- (no CPE)range: < 0.12.4-5.1
- (no CPE)range: < 0.12.4-8.5.1
- (no CPE)range: < 0.12.5-4.1
- (no CPE)range: < 0.12.4-5.1
- (no CPE)range: < 0.12.4-8.5.1
- (no CPE)range: < 0.12.5-4.1
- (no CPE)range: < 0.12.4-5.1
- (no CPE)range: < 0.12.4-8.5.1
- (no CPE)range: < 0.12.5-4.1
Patches
Vulnerability mechanics
References
10- lists.freedesktop.org/archives/spice-devel/2015-October/022191.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1889.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1890.htmlnvd
- www.debian.org/security/2015/dsa-3371nvd
- www.openwall.com/lists/oss-security/2015/10/06/4nvd
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlnvd
- www.securitytracker.com/id/1033753nvd
- www.ubuntu.com/usn/USN-2766-1nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.gentoo.org/glsa/201606-05nvd
News mentions
0No linked articles in our index yet.