Vulnerability CVE-2020-14355: Information

Description

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Severity: MEDIUM (6.6) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-14355
Published: Oct. 7, 2020
Modified: Nov. 9, 2023
Error type identifier: CWE-120

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
SPICEsisyphus0.14.2-alt10.15.2-alt3ALT-PU-2019-1972-1231199Fixed
SPICEp100.14.2-alt10.15.0-alt1ALT-PU-2019-1972-1231199Fixed
SPICEp90.14.2-alt10.15.0-alt1ALT-PU-2019-1989-1231442Fixed
SPICEc10f10.14.2-alt10.15.0-alt1ALT-PU-2019-1972-1231199Fixed
SPICEc9f20.15.0-alt10.15.0-alt1ALT-PU-2021-1963-1273330Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1868435
  • Issue Tracking
  • Patch
  • Vendor Advisory
https://www.openwall.com/lists/oss-security/2020/10/06/10
  • Mailing List
  • Patch
  • Third Party Advisory
DSA-4771
  • Third Party Advisory
USN-4572-1
  • Third Party Advisory
USN-4572-2
  • Third Party Advisory
openSUSE-SU-2020:1803
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20201101 [SECURITY] [DLA 2428-1] spice-gtk security update
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2020:1802
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20201101 [SECURITY] [DLA 2427-1] spice security update
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*
      End excliding
      0.14.2

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
      cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*
      cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top