CVE-2020-14355
Medium
Description
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
SeverityMedium
CVSS6.6
Exploit probability—
Product
Spice
PublishedOct 7, 2020
First seenOct 7, 2020
Weakness typeCWE-120CWE-120
How to fix
Update
- spice_project spice0.14.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| spice_project spice | v < 0.14.2 | 0.14.2 |
| redhat openstack | 16.1 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 20.04 | — |
| debian debian_linux | 9.0 | — |
| opensuse leap | 15.2 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0 | — |
| redhat enterprise_linux_aus | 8.2 | — |
| redhat enterprise_linux_eus | 8.1 | — |
| redhat enterprise_linux_tus | 8.2 | — |
| redhat enterprise_linux_update_services_for_sap_solutions | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.