Debian/spice-vdagent: high 7.8
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary comma
Action: Upgrade spice-vdagent to 0.18.0-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.18.0-1 | - |
Fixed versions
| 0.18.0-1 |
Sources
published · modified · JSON