Debian/spice-vdagent: high 7.8
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary comma
Action: Upgrade spice-vdagent to 0.18.0-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.18.0-1 | - |
Fixed versions
| 0.18.0-1 |
Sources
- osv: DEBIAN-CVE-2017-15108#Debian:13/spice-vdagent
- https://security-tracker.debian.org/tracker/CVE-2017-15108
published · modified · JSON