Debian Patches

Status for spice-vdagent/0.23.0-3

Patch Description Author Forwarded Bugs Origin Last update
disable_test_session_info.patch Disable test-session-info
Requires running systemd which we don't have during the build

it with autopkgtest instead

https://gitlab.freedesktop.org/spice/linux/vd_agent/-/issues/24
https://gitlab.freedesktop.org/spice/linux/vd_agent/-/merge_requests/32		 Jeremy Bicha <jeremy.bicha@canonical.com> no 2022-02-24
Switch-to-spice-vdagent.service-by-default.patch Switch to spice-vdagent.service by default
Add an [Install] section to the user unit and tell systemd to ignore the
.desktop file explicitly.

Also add missing ordering dependencies. Without this, the service fails if
it is started before e.g. $DISPLAY is set.		 Fabian Vogt <fvogt@suse.de> no upstream, https://gitlab.freedesktop.org/spice/linux/vd_agent/-/commit/aa08162f 2023-02-08
CVE-2026-57965.patch fix(udscs): Prevent integer overflow in udscs_write() buf_size calculation

Add a bounds check rejecting messages where size > UINT32_MAX - sizeof(header)
before computing buf_size = sizeof(header) + size. This prevents the 32-bit
unsigned integer wraparound that leads to a tiny allocation followed by a
massive heap-buffer-overflow memcpy, crashing the daemon (DoS).		 Vinz Spring <vinzs@amazon.de> no 2026-07-17
CVE-2026-57966.patch fix(file-xfers): Reject path traversal in file transfer filenames

Add is_safe_filename() validation in vdagent_file_xfers_create_file() that
rejects filenames containing '..' path components or absolute paths. This
prevents a malicious SPICE host from writing arbitrary files outside the
intended save directory via crafted file transfer names.		 Vinz Spring <vinzs@amazon.de> no 2026-07-17

All known versions for source package 'spice-vdagent'

Links