SUSE-SU-2020:3268-1: important: Security update for spice-vdagent

sle-updates at sle-updates at
Tue Nov 10 13:14:52 MST 2020

   SUSE Security Update: Security update for spice-vdagent

Announcement ID:    SUSE-SU-2020:3268-1
Rating:             important
References:         #1173749 #1177780 #1177781 #1177782 #1177783 
Cross-References:   CVE-2020-25650 CVE-2020-25651 CVE-2020-25652
Affected Products:
                    SUSE Linux Enterprise Module for Desktop Applications 15-SP2

   An update that solves four vulnerabilities and has one
   errata is now available.


   This update for spice-vdagent fixes the following issues:

   Security issues fixed:

   - CVE-2020-25650: Fixed a memory DoS via arbitrary entries in
     `active_xfers` hash table (bsc#1177780).
   - CVE-2020-25651: Fixed a possible file transfer DoS and information leak
     via `active_xfers` hash map (bsc#1177781).
   - CVE-2020-25652: Fixed a possibility to exhaust file descriptors in
     `vdagentd` (bsc#1177782).
   - CVE-2020-25653: Fixed a race condition when the UNIX domain socket peer
     PID retrieved via `SO_PEERCRED` (bsc#1177783).

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Desktop Applications 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP2-2020-3268=1

Package List:

   - SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (aarch64 ppc64le s390x x86_64):



More information about the sle-updates mailing list