Updated rhevm-spice-client packages that fix multiple security issues,several bugs, and add one enhancement are now available for Red HatEnterprise Virtualization Manager 3.Red Hat Product Security has rated this update as having Important securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.
Red Hat Enterprise Virtualization Manager provides access to virtualmachines using SPICE. These SPICE client packages provide the SPICE clientand usbclerk service for both Windows 32-bit operating systems and Windows64-bit operating systems.This update adds support for the TLS Fallback Signaling Cipher Suite Value(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgradeattacks against applications which re-connect using a lower SSL/TLSprotocol version when the initial connection indicating the highestsupported protocol version fails.This can prevent a forceful downgrade of the communication to SSL 3.0.The SSL 3.0 protocol was found to be vulnerable to the padding oracleattack when using block cipher suites in cipher block chaining (CBC) mode.This issue is identified as CVE-2014-3566, and also known under the aliasPOODLE. This SSL 3.0 protocol flaw will not be addressed in a futureupdate; it is recommended that users configure their applications torequire at least TLS protocol version 1.0 for secure communication.For additional information about this flaw, see the Knowledgebase articleat https://access.redhat.com/articles/1232123Multiple flaws were found in the way JasPer decoded JPEG 2000 image files.A specially crafted file could cause an application using JasPer to crashor, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157,CVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517,CVE-2008-3520, CVE-2008-3522)Red Hat would like to thank oCERT for reporting CVE-2014-8137,CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516,and CVE-2011-4517. oCERT acknowledges Jose Duart of the Google SecurityTeam as the original reporter of CVE-2014-8137 and CVE-2014-8138; andpyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.The mingw-openssl and mingw-jasper packages have been upgraded to thelatest upstream version, which provides a number of bug fixes andenhancements over the previous version. (BZ#1187585)This update also fixes the following bugs:* Previously, a guest system installed with tools incorrectly alwaysstarted in full screen mode, even when the “Open in Full Screen” option wasunchecked in console options. Now, when connecting in window mode with theoption unchecked, the guest system starts in a window as expected.(BZ#1172126)* Prior to this update, copying and pasting of images from the client tothe guest did not work when spice-gtk was built from upstream. Now, imagescan be copied and pasted without problems. (BZ#1187270)In addition, this update adds the following enhancement:* Administrators now have the option of automatic multiuser installation ofvirt-viewer onto many client workstations. (BZ#1187272)All rhevm-spice-client users are advised to upgrade to these updatedpackages, which correct these issues and add these enhancement.
Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258
1167537 – CVE-2014-9029 jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)1172126 – always fullscreen for SPICE-xpi1173157 – CVE-2014-8137 jasper: double-free in in jas_iccattrval_destroy() (oCERT-2014-012)1173162 – CVE-2014-8138 jasper: heap overflow in jp2_decode() (oCERT-2014-012)1179282 – CVE-2014-8157 jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)1179298 – CVE-2014-8158 jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)1187270 – copy/paste images does not work — images are truncated461476 – CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls461478 – CVE-2008-3522 jasper: possible buffer overflow in jas_stream_printf()747726 – CVE-2011-4516 CVE-2011-4517 jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from: