Vulnerability Details CVE-2020-14355
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.013
EPSS Ranking 78.8%
CVSS Severity
CVSS v3 Score 6.6
CVSS v2 Score 6.5
References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1868435
- https://lists.debian.org/debian-lts-announce/2020/11/msg00001.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00002.html
- https://usn.ubuntu.com/4572-1/
- https://usn.ubuntu.com/4572-2/
- https://www.debian.org/security/2020/dsa-4771
- https://www.openwall.com/lists/oss-security/2020/10/06/10
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1868435
- https://lists.debian.org/debian-lts-announce/2020/11/msg00001.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00002.html
- https://usn.ubuntu.com/4572-1/
- https://usn.ubuntu.com/4572-2/
- https://www.debian.org/security/2020/dsa-4771
- https://www.openwall.com/lists/oss-security/2020/10/06/10
Products affected by CVE-2020-14355
-
cpe:2.3:a:redhat:openstack:16.1
-
cpe:2.3:a:spice_project:spice:-
-
cpe:2.3:a:spice_project:spice:0.10.0
-
cpe:2.3:a:spice_project:spice:0.10.1
-
cpe:2.3:a:spice_project:spice:0.11.0
-
cpe:2.3:a:spice_project:spice:0.11.3
-
cpe:2.3:a:spice_project:spice:0.12.0
-
cpe:2.3:a:spice_project:spice:0.12.2
-
cpe:2.3:a:spice_project:spice:0.12.3
-
cpe:2.3:a:spice_project:spice:0.12.4
-
cpe:2.3:a:spice_project:spice:0.12.5
-
cpe:2.3:a:spice_project:spice:0.12.6
-
cpe:2.3:a:spice_project:spice:0.12.7
-
cpe:2.3:a:spice_project:spice:0.12.8
-
cpe:2.3:a:spice_project:spice:0.13.0
-
cpe:2.3:a:spice_project:spice:0.13.1
-
cpe:2.3:a:spice_project:spice:0.13.2
-
cpe:2.3:a:spice_project:spice:0.13.3
-
cpe:2.3:a:spice_project:spice:0.13.90
-
cpe:2.3:a:spice_project:spice:0.13.91
-
cpe:2.3:a:spice_project:spice:0.14.0
-
cpe:2.3:a:spice_project:spice:0.14.1
-
cpe:2.3:a:spice_project:spice:0.5.2
-
cpe:2.3:a:spice_project:spice:0.5.3
-
cpe:2.3:a:spice_project:spice:0.6.0
-
cpe:2.3:a:spice_project:spice:0.6.1
-
cpe:2.3:a:spice_project:spice:0.6.2
-
cpe:2.3:a:spice_project:spice:0.6.3
-
cpe:2.3:a:spice_project:spice:0.6.4
-
cpe:2.3:a:spice_project:spice:0.7.0
-
cpe:2.3:a:spice_project:spice:0.7.1
-
cpe:2.3:a:spice_project:spice:0.7.2
-
cpe:2.3:a:spice_project:spice:0.7.3
-
cpe:2.3:a:spice_project:spice:0.8.0
-
cpe:2.3:a:spice_project:spice:0.8.1
-
cpe:2.3:a:spice_project:spice:0.8.2
-
cpe:2.3:a:spice_project:spice:0.8.3
-
cpe:2.3:a:spice_project:spice:0.9.0
-
cpe:2.3:a:spice_project:spice:0.9.1
-
cpe:2.3:o:canonical:ubuntu_linux:14.04
-
cpe:2.3:o:canonical:ubuntu_linux:16.04
-
cpe:2.3:o:canonical:ubuntu_linux:18.04
-
cpe:2.3:o:canonical:ubuntu_linux:20.04
-
cpe:2.3:o:debian:debian_linux:9.0
-
cpe:2.3:o:opensuse:leap:15.2
-
cpe:2.3:o:redhat:enterprise_linux:6.0
-
cpe:2.3:o:redhat:enterprise_linux:7.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux_aus:8.2
-
cpe:2.3:o:redhat:enterprise_linux_eus:8.1
-
cpe:2.3:o:redhat:enterprise_linux_tus:8.2
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0