CVE catalog

CVE-2018-10873

spice: CVE-2018-10873

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.93% · Oct 25, 2026

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspicesid0.16.0-3fixed
Debianspiceforky0.16.0-3fixed
Debianspicetrixie0.15.2-1fixed
Debianspicebookworm0.15.1-1fixed
Debianspice-gtksid0.42-4fixed
Debianspice-gtkforky0.42-4fixed
Debianspice-gtktrixie0.42-3fixed
Debianspice-gtkbookworm0.42-1fixed
Alpinespice3.100.14.1-r0fixed
Alpinespice3.110.14.1-r0fixed
Alpinespice3.120.14.1-r0fixed
Alpinespice3.130.14.1-r0fixed
Alpinespice3.140.14.1-r0fixed
Alpinespice3.150.14.1-r0fixed
Alpinespice3.160.14.1-r0fixed
Alpinespice3.170.14.1-r0fixed
Alpinespice3.180.14.1-r0fixed
Alpinespice3.190.14.1-r0fixed
Alpinespice3.200.14.1-r0fixed
Alpinespice3.210.14.1-r0fixed
Alpinespice3.220.14.1-r0fixed
Alpinespice3.230.14.1-r0fixed
Alpinespice3.240.14.1-r0fixed
Alpinespice3.50.12.8-r4fixed
Alpinespice3.60.13.3-r3fixed
Alpinespice3.70.14.1-r0fixed
Alpinespice3.80.14.1-r0fixed
Alpinespice3.90.14.1-r0fixed
Ubuntuspice14.040.12.4-0nocelt1vulnerable
Ubuntuspice14.040.12.4-0nocelt1.1vulnerable
Ubuntuspice14.040.12.4-0nocelt1.1ubuntu1vulnerable
Ubuntuspice14.040.12.4-0nocelt2vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.1vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.2vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.3vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.4vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.5vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.6vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.7fixed
Ubuntuspice-protocol16.040.12.7-1vulnerable
Ubuntuspice-protocol16.040.12.10-1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.2fixed
Ubuntuspice18.040.12.8-2.2vulnerable
Ubuntuspice18.040.14.0-1vulnerable
Ubuntuspice18.040.14.0-1ubuntu1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.2fixed
Ubuntuspice14.040.12.4-0nocelt1vulnerable
Ubuntuspice14.040.12.4-0nocelt1.1vulnerable
Ubuntuspice14.040.12.4-0nocelt1.1ubuntu1vulnerable
Ubuntuspice14.040.12.4-0nocelt2vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.1vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.2vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.3vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.4vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.5vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.6vulnerable
Ubuntuspice14.040.12.4-0nocelt2ubuntu1.7fixed
Ubuntuspice-protocol16.040.12.7-1vulnerable
Ubuntuspice-protocol16.040.12.10-1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.2fixed
Ubuntuspice-gtk16.040.28-1ubuntu1vulnerable
Ubuntuspice-gtk16.040.29-1vulnerable
Ubuntuspice-gtk16.040.30-1vulnerable
Ubuntuspice18.040.12.8-2.2vulnerable
Ubuntuspice18.040.14.0-1vulnerable
Ubuntuspice18.040.14.0-1ubuntu1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.2fixed
Ubuntuspice-gtk18.040.33-3.3vulnerable
Ubuntuspice-gtk18.040.34-1.1vulnerable
Ubuntuspice-gtk18.040.34-1.1build1vulnerable
Susespice-gtklinux enterprise server 12-ltss0.25-5.3.1fixed
Susespice-gtkopenstack cloud 70.31-9.10.1fixed
Susespice-gtklinux enterprise server for sap applications 12 sp20.31-9.10.1fixed
Susespice-gtklinux enterprise server 12 sp2-ltss0.31-9.10.1fixed
Susespice-gtklinux enterprise server 12 sp2-bcl0.31-9.10.1fixed
Susespicelinux enterprise desktop 12 sp30.12.8-6.1fixed
Susespicelinux enterprise software development kit 12 sp30.12.8-6.1fixed
Susespicelinux enterprise server 12 sp30.12.8-6.1fixed
Susespicelinux enterprise server for sap applications 12 sp30.12.8-6.1fixed
Susespicelinux enterprise server 12-ltss0.12.4-8.18.1fixed
Susespicelinux enterprise software development kit 11 sp40.12.4-15.1fixed
Susespicelinux enterprise server 11 sp40.12.4-15.1fixed
Susespicelinux enterprise server for sap applications 11 sp40.12.4-15.1fixed
Susespiceopenstack cloud 70.12.7-10.9.1fixed
Susespicelinux enterprise server for sap applications 12 sp20.12.7-10.9.1fixed
Susespicelinux enterprise server 12 sp2-ltss0.12.7-10.9.1fixed
Susespicelinux enterprise server 12 sp2-bcl0.12.7-10.9.1fixed
Susespice-gtklinux enterprise desktop 12 sp30.33-3.6.1fixed
Susespice-gtklinux enterprise software development kit 12 sp30.33-3.6.1fixed
Susespice-gtklinux enterprise server 12 sp30.33-3.6.1fixed
Susespice-gtklinux enterprise server for sap applications 12 sp30.33-3.6.1fixed
Susespice-gtklinux enterprise module for basesystem 150.34-3.3.1fixed
Susespice-gtklinux enterprise module for server applications 150.34-3.3.1fixed
Opensusespice-gtktumbleweed0.39-1.8fixed
Susespicelinux enterprise module for server applications 150.14.0-4.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspicesourcesid0.14.0-1.1not yet assignedNot reported[906315]
Debianspicesourceforky0.14.0-1.1not yet assignedNot reported[906315]
Debianspicesourcetrixie0.14.0-1.1not yet assignedNot reported[906315]
Debianspicesourcebookworm0.14.0-1.1not yet assignedNot reported[906315]
Debianspice-gtksourcesid0.35-1not yet assignedNot reported[906316]
Debianspice-gtksourceforky0.35-1not yet assignedNot reported[906316]
Debianspice-gtksourcetrixie0.35-1not yet assignedNot reported[906316]
Debianspice-gtksourcebookworm0.35-1not yet assignedNot reported[906316]
Alpinespiceapk3.100.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.110.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.120.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.130.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.140.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.150.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.160.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.170.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.180.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.190.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.200.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.210.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.220.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.230.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.240.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.50.12.8-r4Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.60.13.3-r3Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.70.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.80.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Alpinespiceapk3.90.14.1-r0Not reportedALPINE-CVE-2018-10873Not reported
Ubuntuspicedeb14.040.12.4-0nocelt2ubuntu1.7Not reportedUSN-3751-1Not reported
Ubuntuspice-protocoldeb16.040.12.10-1ubuntu0.2Not reportedUSN-3751-1Not reported
Ubuntuspicedeb18.040.14.0-1ubuntu2.2Not reportedUSN-3751-1Not reported
Ubuntuspicedeb14.040.12.4-0nocelt2ubuntu1.7Not reportedUBUNTU-CVE-2018-10873Not reported
Ubuntuspice-protocoldeb16.040.12.10-1ubuntu0.2Not reportedUBUNTU-CVE-2018-10873Not reported
Ubuntuspicedeb18.040.14.0-1ubuntu2.2Not reportedUBUNTU-CVE-2018-10873Not reported
Susespice-gtkrpmlinux enterprise server 12-ltss0.25-5.3.1Not reportedSUSE-SU-2018:2593-1Not reported
Susespice-gtkrpmopenstack cloud 70.31-9.10.1Not reportedSUSE-SU-2020:3841-1Not reported
Susespice-gtkrpmlinux enterprise server for sap applications 12 sp20.31-9.10.1Not reportedSUSE-SU-2020:3841-1Not reported
Susespice-gtkrpmlinux enterprise server 12 sp2-ltss0.31-9.10.1Not reportedSUSE-SU-2020:3841-1Not reported
Susespice-gtkrpmlinux enterprise server 12 sp2-bcl0.31-9.10.1Not reportedSUSE-SU-2020:3841-1Not reported
Susespicerpmlinux enterprise desktop 12 sp30.12.8-6.1Not reportedSUSE-SU-2018:2595-1Not reported
Susespicerpmlinux enterprise software development kit 12 sp30.12.8-6.1Not reportedSUSE-SU-2018:2595-1Not reported
Susespicerpmlinux enterprise server 12 sp30.12.8-6.1Not reportedSUSE-SU-2018:2595-1Not reported
Susespicerpmlinux enterprise server for sap applications 12 sp30.12.8-6.1Not reportedSUSE-SU-2018:2595-1Not reported
Susespicerpmlinux enterprise server 12-ltss0.12.4-8.18.1Not reportedSUSE-SU-2018:2584-1Not reported
Susespicerpmlinux enterprise software development kit 11 sp40.12.4-15.1Not reportedSUSE-SU-2018:2563-1Not reported
Susespicerpmlinux enterprise server 11 sp40.12.4-15.1Not reportedSUSE-SU-2018:2563-1Not reported
Susespicerpmlinux enterprise server for sap applications 11 sp40.12.4-15.1Not reportedSUSE-SU-2018:2563-1Not reported
Susespicerpmopenstack cloud 70.12.7-10.9.1Not reportedSUSE-SU-2020:3842-1Not reported
Susespicerpmlinux enterprise server for sap applications 12 sp20.12.7-10.9.1Not reportedSUSE-SU-2020:3842-1Not reported
Susespicerpmlinux enterprise server 12 sp2-ltss0.12.7-10.9.1Not reportedSUSE-SU-2020:3842-1Not reported
Susespicerpmlinux enterprise server 12 sp2-bcl0.12.7-10.9.1Not reportedSUSE-SU-2020:3842-1Not reported
Susespice-gtkrpmlinux enterprise desktop 12 sp30.33-3.6.1Not reportedSUSE-SU-2018:2594-1Not reported
Susespice-gtkrpmlinux enterprise software development kit 12 sp30.33-3.6.1Not reportedSUSE-SU-2018:2594-1Not reported
Susespice-gtkrpmlinux enterprise server 12 sp30.33-3.6.1Not reportedSUSE-SU-2018:2594-1Not reported
Susespice-gtkrpmlinux enterprise server for sap applications 12 sp30.33-3.6.1Not reportedSUSE-SU-2018:2594-1Not reported
Susespice-gtkrpmlinux enterprise module for basesystem 150.34-3.3.1Not reportedSUSE-SU-2018:2709-1Not reported
Susespice-gtkrpmlinux enterprise module for server applications 150.34-3.3.1Not reportedSUSE-SU-2018:2709-1Not reported
Opensusespice-gtkrpmtumbleweed0.39-1.8Not reportedOPENSUSE-SU-2024:11398-1Not reported
Susespicerpmlinux enterprise module for server applications 150.14.0-4.3.1Not reportedSUSE-SU-2018:2566-1Not reported

[Debian bug #906315][Debian bug #906316]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

  • Source package: [spice-gtk]

    Details (1)
    • 0.43-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.39-1.8

      Version impact unknown

      dsa · spice-gtk · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice]

    Details (2)
    • 0.15.1-1 · amd64 · bookworm

      Fixed · Fixed: 0.14.0-1.1

      dsa · spice · debian · bookworm; dsa · spice · debian · 12

    • 0.15.1-1 · arm64 · bookworm

      Fixed · Fixed: 0.14.0-1.1

      dsa · spice · debian · bookworm; dsa · spice · debian · 12

  • Source package: [spice]

    Details (2)
    • 0.15.1-1 · amd64 · bookworm

      Fixed · Fixed: 0.14.0-1.1

      dsa · spice · debian · bookworm; dsa · spice · debian · 12

    • 0.15.1-1 · arm64 · bookworm

      Fixed · Fixed: 0.14.0-1.1

      dsa · spice · debian · bookworm; dsa · spice · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-1 · amd64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

    • 0.42-1 · arm64 · bookworm

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · bookworm; dsa · spice-gtk · debian · 12

[Debian 13 (Trixie)]

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-3 · amd64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

    • 0.42-3 · arm64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-3 · amd64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

    • 0.42-3 · arm64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

  • Source package: [spice-gtk]

    Details (2)
    • 0.42-3 · amd64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

    • 0.42-3 · arm64 · trixie

      Fixed · Fixed: 0.35-1

      dsa · spice-gtk · debian · 13

Next results

Observed:

References