CVE-2015-3247

Name of the Vulnerable Software and Affected Versions SPICE version 0.12.4

Description A race condition in the worker update monitors config function allows a remote authenticated guest user to cause a denial of service, resulting in heap-based memory corruption and QEMU-KVM crash, or possibly execute arbitrary code on the host.

Recommendations For SPICE version 0.12.4, consider disabling the worker update monitors config function as a temporary workaround until a patch is available. Restrict access to the QEMU-KVM process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.