NetSight
IP …
medium6.6

CVE-2020-14355

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1.

Impact

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Affected products

VendorProductAffected versions
Spice ProjectSpice
before 0.14.2
RedhatOpenstack
Version 16.1
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 20.04
DebianDebian Linux
Version 9.0
OpensuseLeap
Version 15.2
RedhatEnterprise Linux
Versions 6.0, 7.0, 8.0
RedhatEnterprise Linux Aus
Version 8.2
RedhatEnterprise Linux Eus
Version 8.1
RedhatEnterprise Linux Tus
Version 8.2
RedhatEnterprise Linux Update Services For Sap Solutions
Version 8.0

Weakness classification

CWE-120

References