CVE-2026-57965

CVE-2026-57965 describes a vulnerability in spice-vdagent where an integer overflow in udscs_write() can cause a heap buffer overflow, crashing the spice-vdagent daemon and resulting in a Denial of Service for the guest VM. Exploitation requires a malicious or compromised SPICE host, i.e., an unt...

CVE-2026-57966

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized...

CVE-2026-57965

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service DoS for the virtua...

PT-2026-53237

Name of the Vulnerable Software and Affected Versions spice-vdagent affected versions not specified Description A flaw exists where a malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This leads to a heap buffer overflow within the udscs...

PT-2026-53238

Name of the Vulnerable Software and Affected Versions spice-vdagent affected versions not specified Description A path traversal flaw exists in spice-vdagent, where a path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root...

Unity Linux 20.1060e / 20.1070e Security Update: spice-vdagent (UTSA-2026-016611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016611 advisory. A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with acce...

Unity Linux 20.1060e / 20.1070e Security Update: spice-vdagent (UTSA-2026-016620)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016620 advisory. A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local...

Security update for qemu

This update for qemu fixes the following issues: CVE-2026-0665: Added PIRQ bounds check in xenphysdevmappirq to avoid an out-of-bounds heap. bsc1256484 Other fixes: Fixed that QEMU migration fails if a qemu-vdagent channel is present in the VM bsc1257474 Patch Instructions: To install this SUSE...

MiracleLinux 8 : spice-vdagent-0.20.0-3.el8 (AXSA:2021-2117:03)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2117:03 advisory. spice-vdagent: possible file transfer DoS and information leak via activexfers hash map CVE-2020-25651 spice-vdagent: UNIX domain socket peer PID...

EUVD-2020-18315

Malware in sbrugna...

EUVD-2020-18314

Malware in sbrugna...

EUVD-2017-6573

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2020-25651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate...

Linux Distros Unpatched Vulnerability : CVE-2020-25650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with...

TencentOS Server 3: spice-vdagent (TSSA-2022:0084)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0084 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Alibaba Cloud Linux 3 : 0084: spice-vdagent (ALINUX3-SA-2022:0084)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0084 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-25650: A flaw was found in the wa...

Linux Distros Unpatched Vulnerability : CVE-2017-15108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the...

RHSA-2021:1791 Red Hat Security Advisory: spice-vdagent security and bug fix update

Bulletin has no description...

OPENSUSE-SU-2024:11399-1 spice-vdagent-0.21.0-1.7 on GA media

These are all security issues fixed in the spice-vdagent-0.21.0-1.7 package on the GA media of openSUSE Tumbleweed...

RHEL 7 : spice-vdagent-win (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - rhevm: spice service unquoted search path CVE-2013-2152 Note that Nessus has not tested for this issue but has...