Published: 07/10/2020 Updated: 09/11/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 6.6 | Impact Score: 3.7 | Exploitability Score: 2.3

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
spice project spice
redhat enterprise linux 7.0
redhat enterprise linux 6.0
canonical ubuntu linux 16.04
debian debian linux 9.0
canonical ubuntu linux 18.04
canonical ubuntu linux 14.04
redhat enterprise linux 8.0
redhat enterprise linux eus 8.1
canonical ubuntu linux 20.04
opensuse leap 15.2
redhat enterprise linux aus 8.2
redhat openstack 16.1
redhat enterprise linux tus 8.2
redhat enterprise linux update services for sap solutions 8.0

Debian Bug report logs - #971750 spice: CVE-2020-14355 Package: src:spice; Maintainer for src:spice is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Oct 2020 12:27:04 UTC Severity: grave Tags: security, upstream Found in versions spice/ ...

Frediano Ziglio discovered multiple buffer overflow vulnerabilities in the QUIC image decoding process of spice, a SPICE protocol client and server library, which could result in denial of service, or possibly, execution of arbitrary code For the stable distribution (buster), this problem has been fixed in version 0140-13+deb10u1 We recommend ...

Synopsis Important: spice and spice-gtk security update Type/Severity Security Advisory: Important Topic An update for spice and spice-gtk is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Importa ...

Synopsis Important: spice and spice-gtk security update Type/Severity Security Advisory: Important Topic An update for spice and spice-gtk is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Comm ...

Synopsis Important: spice and spice-gtk security update Type/Severity Security Advisory: Important Topic An update for spice and spice-gtk is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...

Synopsis Important: spice and spice-gtk security update Type/Severity Security Advisory: Important Topic An update for spice and spice-gtk is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system Both the SPICE client (spice-gtk) and server are affected by these flaws These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in ...

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system More specifically, these flaws reside in the spice-common shared code between the client and server of SPICE In other words, both the client (spice-gtk) and server are affected by these flaws A malicious client or server coul ...

CWE-120 https://bugzilla.redhat.com/show_bug.cgi?id=1868435 https://www.openwall.com/lists/oss-security/2020/10/06/10 https://www.debian.org/security/2020/dsa-4771 https://usn.ubuntu.com/4572-1/https://usn.ubuntu.com/4572-2/http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.html https://lists.debian.org/debian-lts-announce/2020/11/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.html https://lists.debian.org/debian-lts-announce/2020/11/msg00001.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971750 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4771

Get Started

CVE-2020-14355

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect