CVE-2017-15108: OS Command Injection
Published Jan 20, 2018
·Updated
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
Affected Software
2 affected components
Spice-space Spice-vdagent<=0.17.0
Debian Debian Linux=9.0
Remediation
Event History
Jan 20, 2018
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-15108?
The severity of CVE-2017-15108 is high with a CVSS score of 7.8.
2
What is the description of CVE-2017-15108?
CVE-2017-15108 is a vulnerability in spice-vdagent up to and including version 0.17.0, which allows a local attacker to inject arbitrary commands.
3
Which software versions are affected by CVE-2017-15108?
spice-vdagent up to and including version 0.17.0 and Debian Linux version 9.0 are affected by CVE-2017-15108.
4
How can a local attacker exploit CVE-2017-15108?
A local attacker with access to the session the agent runs in can exploit CVE-2017-15108 by injecting arbitrary commands.
5
Is there a fix available for CVE-2017-15108?
Yes, you can find information about the fix for CVE-2017-15108 in the provided references.