What’s Vulnerable › Vulnerabilities

CVE-2016-9578

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-27 · updated 2026-06-17
• Weakness: CWE-20

Description

A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

Affected products

• Debian Linux: 8.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4
• RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• The SPICE Project spice: before 0.13.90 — fixed in 0.13.90

How to fix

Upgrade to a fixed version: The SPICE Project spice 0.13.90. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2017-0253.html
• http://rhn.redhat.com/errata/RHSA-2017-0549.html
• http://www.securityfocus.com/bid/96118
• https://access.redhat.com/errata/RHSA-2017:0254
• https://access.redhat.com/errata/RHSA-2017:0552
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9578
• https://www.debian.org/security/2017/dsa-3790
• http://rhn.redhat.com/errata/RHSA-2017-0253.html
• http://rhn.redhat.com/errata/RHSA-2017-0549.html
• http://www.securityfocus.com/bid/96118
• https://access.redhat.com/errata/RHSA-2017:0254
• https://access.redhat.com/errata/RHSA-2017:0552

Get alerted when CVE-2016-9578 or the next vulnerability affects your stack