CVE:CVE-2015-5261
CNNVD:CNNVD-201510-618
Red Hat SPICE是美国红帽（Red Hat）公司的一个企业虚拟化桌面版所使用的自适应远程呈现开源协议，它主要用于将用户与其虚拟桌面进行连接，能够提供与物理桌面完全相同的最终用户体验。
Red Hat SPICE 0.12.6之前版本中存在基于堆的缓冲区溢出漏洞。虚拟机端攻击者可借助虚拟机QXL命令利用该漏洞读取或写入任意内存位置。
solution:Upgrade canonical ubuntu_linux to a higher version than 14.04,15.04,and avoid the version 14.04,15.04; Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_hpc_node to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server_eus to a higher version than 6.7.z,7.1,and avoid the version 6.7.z,7.1; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_hpc_node_eus to a higher version than 7.1,and avoid the version 7.1; Upgrade debian debian_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade spice_project spice to a higher version than 0.12.5,and avoid the version (,0.12.5]