Debian Patches
Status for spice-vdagent/0.22.1-3+deb12u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| systemd_service_default_file.patch | Adjust the path to the default file | Laurent Bigonville <bigon@debian.org> | not-needed | |||
| disable_test_session_info.patch | Disable test-session-info Requires running systemd which we don't have during the build it with autopkgtest instead https://gitlab.freedesktop.org/spice/linux/vd_agent/-/issues/24 https://gitlab.freedesktop.org/spice/linux/vd_agent/-/merge_requests/32 |
Jeremy Bicha <jeremy.bicha@canonical.com> | no | 2022-02-24 | ||
| CVE-2026-57965.patch | fix(udscs): Prevent integer overflow in udscs_write() buf_size calculation Add a bounds check rejecting messages where size > UINT32_MAX - sizeof(header) before computing buf_size = sizeof(header) + size. This prevents the 32-bit unsigned integer wraparound that leads to a tiny allocation followed by a massive heap-buffer-overflow memcpy, crashing the daemon (DoS). |
Vinz Spring <vinzs@amazon.de> | no | 2026-07-17 | ||
| CVE-2026-57966.patch | fix(file-xfers): Reject path traversal in file transfer filenames Add is_safe_filename() validation in vdagent_file_xfers_create_file() that rejects filenames containing '..' path components or absolute paths. This prevents a malicious SPICE host from writing arbitrary files outside the intended save directory via crafted file transfer names. |
Vinz Spring <vinzs@amazon.de> | no | 2026-07-17 |
All known versions for source package 'spice-vdagent'
- 0.23.0-3 (sid)
- 0.23.0-2 (forky)
- 0.22.1-4.1 (trixie)
- 0.22.1-3+deb12u1 (bookworm-security)
- 0.22.1-3 (bookworm)