CESA-2013:1273 -- centos 6 spice-gtkID: oval:org.secpod.oval:def:202941 | Date: (C)2013-10-08 (M)2023-07-28 |
Class: PATCH | Family: unix |
The spice-gtk packages provide a GIMP Toolkit widget for SPICE clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol. spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.