The Simple Protocol for Independent Computing Environments is a remote display protocol used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine hypervisor, or on Red Hat Enterprise Virtualization Hypervisor. It was found that the libspice component of QEMU-KVM on the host did not validate all pointers provided from a guest system"s QXL graphics card driver. A privileged guest user could use this flaw to cause the host to dereference an invalid pointer, causing the guest to crash or, possibly, resulting in the privileged guest user escalating their privileges on the host. It was found that the libspice component of QEMU-KVM on the host could be forced to perform certain memory management operations on memory addresses controlled by a guest. A privileged guest user could use this flaw to crash the guest or, possibly, escalate their privileges on the host. All qspice users should upgrade to these updated packages, which contain backported patches to correct these issues.