{
  "cveId": "CVE-2017-15108",
  "url": "https://patchblox.com/security/cve/CVE-2017-15108",
  "summary": "CVE-2017-15108 is fixed in spice-vdagent on 1 platform, first by spice-vdagent 0.17.0-1ubuntu2, released January 19, 2018. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "spice-vdagent: spice-vdagent up to and including 0.17.0 does not properly escape savedirectory before passing to shell, allowing loc...",
  "description": "spice-vdagent up to and including 0.17.0 does not properly escape savedirectory before passing to shell, allowing local attacker with access tothe session the agent runs in to inject arbitrary commands to be executed.",
  "published": "2018-01-19T16:29:00Z",
  "severity": "Medium",
  "epss": 0.00419,
  "epssPercentile": 0.36492,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "spice-vdagent",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "0.17.0-1ubuntu2",
      "fix": "spice-vdagent 0.17.0-1ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-spice-vdagent-0.17.0-1ubuntu2",
      "released": "2018-01-19T16:29:00Z"
    },
    {
      "platform": "linux",
      "product": "spice-vdagent",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "0.17.0-1ubuntu2",
      "fix": "spice-vdagent 0.17.0-1ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-spice-vdagent-0.17.0-1ubuntu2",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "spice-vdagent",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "0.17.0-1ubuntu2",
      "fix": "spice-vdagent 0.17.0-1ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-spice-vdagent-0.17.0-1ubuntu2",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}