A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.

A path traversal vulnerability was found in spice-vdagent. In src/vdagent/file-xfers.c, the filename received from the SPICE host in file transfer metadata is used directly in gbuildfilename() without any sanitization (file-xfers.c:138-139, 190). The gbuildfilename() function has documented behavior where if the second argument is an absolute path (starts with '/'), the first argument (savedir) is silently discarded. Additionally, '..' components in relative paths are not stripped, enabling directory traversal.

This allows a malicious SPICE host to write arbitrary files at arbitrary paths on the guest filesystem, with the privileges of the spice-vdagent process (typically the logged-in user).

Note: this is distinct from CVE-2017-15108, which was about unescaped savedir passed to system() (command injection, CWE-78). This finding concerns the file name parameter not being sanitized for path traversal (CWE-22) — different input variable, different vulnerability class. Exploitation requires a malicious or compromised SPICE host.