Security Advisory Important: rhevm-spice-client security, bug fix, and enhancement update

Advisory: RHSA-2015:0698-1
Type: Security Advisory
Severity: Important
Issued on: 2015-03-18
Last updated on: 2015-03-18
Affected Products: Red Hat Enterprise Virtualization 3.5
CVEs ( CVE-2008-3520


Updated rhevm-spice-client packages that fix multiple security issues,
several bugs, and add one enhancement are now available for Red Hat
Enterprise Virtualization Manager 3.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Red Hat Enterprise Virtualization Manager provides access to virtual
machines using SPICE. These SPICE client packages provide the SPICE client
and usbclerk service for both Windows 32-bit operating systems and Windows
64-bit operating systems.

This update adds support for the TLS Fallback Signaling Cipher Suite Value
(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade
attacks against applications which re-connect using a lower SSL/TLS
protocol version when the initial connection indicating the highest
supported protocol version fails.

This can prevent a forceful downgrade of the communication to SSL 3.0.
The SSL 3.0 protocol was found to be vulnerable to the padding oracle
attack when using block cipher suites in cipher block chaining (CBC) mode.
This issue is identified as CVE-2014-3566, and also known under the alias
POODLE. This SSL 3.0 protocol flaw will not be addressed in a future
update; it is recommended that users configure their applications to
require at least TLS protocol version 1.0 for secure communication.

For additional information about this flaw, see the Knowledgebase article

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to crash
or, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157,
CVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517,
CVE-2008-3520, CVE-2008-3522)

Red Hat would like to thank oCERT for reporting CVE-2014-8137,
CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516,
and CVE-2011-4517. oCERT acknowledges Jose Duart of the Google Security
Team as the original reporter of CVE-2014-8137 and CVE-2014-8138; and
pyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.

The mingw-openssl and mingw-jasper packages have been upgraded to the
latest upstream version, which provides a number of bug fixes and
enhancements over the previous version. (BZ#1187585)

This update also fixes the following bugs:

* Previously, a guest system installed with tools incorrectly always
started in full screen mode, even when the "Open in Full Screen" option was
unchecked in console options. Now, when connecting in window mode with the
option unchecked, the guest system starts in a window as expected.

* Prior to this update, copying and pasting of images from the client to
the guest did not work when spice-gtk was built from upstream. Now, images
can be copied and pasted without problems. (BZ#1187270)

In addition, this update adds the following enhancement:

* Administrators now have the option of automatic multiuser installation of
virt-viewer onto many client workstations. (BZ#1187272)

All rhevm-spice-client users are advised to upgrade to these updated
packages, which correct these issues and add these enhancement.


Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

Updated packages

Red Hat Enterprise Virtualization 3.5

rhevm-spice-client-3.5-3.el6.src.rpm     MD5: ddeff2d79fa76196cf2c6561b90ae142
SHA-256: 5631c1f8bab6f2c2e918343207bac125ed61736a9675c958ffefbfc0571c9d55
rhevm-spice-client-x64-cab-3.5-3.el6.noarch.rpm     MD5: 0ffac2c75ae3d637ddcc01aad480fe74
SHA-256: 2b94e298ba8905fb6b2f2af943ed910b3c849f2250645153f0d601954b698493
rhevm-spice-client-x64-msi-3.5-3.el6.noarch.rpm     MD5: d9481c58b5404fb03d0bf9a3d80090d2
SHA-256: 2686e93658fd473837985602a639b28ce335234b645793a3a0157ffa8a961b51
rhevm-spice-client-x86-cab-3.5-3.el6.noarch.rpm     MD5: 8723f44cafafc84c27dc651281093e08
SHA-256: 6e03e51ee804ea209abe506211d8a42abea68ed9d3ece30418915c4fa231b9c8
rhevm-spice-client-x86-msi-3.5-3.el6.noarch.rpm     MD5: 35e28a1a349c214189222f4ac17a1cc9
SHA-256: 785287675302f0d4e37d0c03b6a48776a76dea5f31856e2e9f6d56a84d768023
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1167537 - CVE-2014-9029 jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)
1172126 - always fullscreen for SPICE-xpi
1173157 - CVE-2014-8137 jasper: double-free in in jas_iccattrval_destroy() (oCERT-2014-012)
1173162 - CVE-2014-8138 jasper: heap overflow in jp2_decode() (oCERT-2014-012)
1179282 - CVE-2014-8157 jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)
1179298 - CVE-2014-8158 jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)
1187270 - copy/paste images does not work -- images are truncated
461476 - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls
461478 - CVE-2008-3522 jasper: possible buffer overflow in jas_stream_printf()
747726 - CVE-2011-4516 CVE-2011-4517 jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:

The Red Hat security contact is More contact details at