Synopsis:   Moderate: spice-xpi security update
Issue date: 2011-04-07
CVE Names:  CVE-2011-0012
             CVE-2011-1179

An uninitialized pointer use flaw was found in the SPICE Firefox plug-in.
If a user were tricked into visiting a malicious web page with Firefox
while the SPICE plug-in was enabled, it could cause Firefox to crash or,
possibly, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-1179)

It was found that the SPICE Firefox plug-in used a predictable name for one
of its log files. A local attacker could use this flaw to conduct a
symbolic link attack, allowing them to overwrite arbitrary files accessible
to the user running Firefox. (CVE-2011-0012)

SL 5.x
     SRPMS:
         spice-xpi-2.2-2.3.el5_6.1.src.rpm

     i386:
         spice-xpi-2.2-2.3.el5_6.1.i386.rpm

     x86_64:
         spice-xpi-2.2-2.3.el5_6.1.x86_64.rpm

SL 6.x
     SRPMS:
         spice-xpi-2.4-1.el6_0.2.src.rpm

     i386:
         spice-xpi-2.4-1.el6_0.2.i686.rpm

     x86_64:
         spice-xpi-2.4-1.el6_0.2.x86_64.rpm

- Scientific Linux Development Team