CVE-2020-14355

Summary of CVE-2020-14355 : Multiple buffer overflow vulnerabilities were found in the QUIC image decoding path of SPICE, affecting both client and server components (spice-gtk, spice-server, and shared spice-common code). The flaws could allow a remote attacker to send crafted QUIC messages that...

CVE-2019-3813

Spice versions 0.5.2–0.14.1 are affected by an off-by-one in memslot_get_virt causing an out-of-bounds read. Root consequences include possible denial of service and, in the worst case, remote code execution by unauthenticated attackers. Public advisories confirm fixes: Arch Linux and Red Hat adv...

CVE-2021-20201

The CVE-2021-20201 issue affects SPICE, specifically the SPICE server prior to version 0.15.0. A denial-of-service condition exists where an attacker can trigger high CPU usage by performing many renegotiations within a single connection. Arch Linux advisory confirms the remediation is upgrading ...

CVE-2018-10873

CVE-2018-10873 affects SPICE before 0.14.1: a missing bounds check in demarshal.py:write_validate_array_item can be exploited by an authenticated remote peer to crash the SPICE client/server. Public advisories (Debian, IBM, Mageia/CentOS) describe denial of service and potential code execution im...

CVE-2018-10893

CVE-2018-10893 concerns spice-client’s handling of LZ compressed frames, with multiple integer/buffer overflow issues that could crash the client or allow arbitrary code execution. Public advisories reference fixes bundled in updated spice packages: Amazon Linux 2 ALAS-2023-2219 notes spice-proto...

CVE-2017-7506

CVE-2017-7506 affects SPICE up to version 0.13, where an authenticated attacker can trigger an out-of-bounds memory access in the spice-server when processing crafted messages, potentially crashing the server or leaking memory. The issue has been addressed in multiple distributions (e.g., RH/Cent...

CVE-2016-9578

CVE-2016-9578 affects SPICE prior to 0.13.90 in the server’s protocol handling. The issue is caused by the server’s improper validation of incoming messages, allowing an attacker who can connect to the SPICE server to send crafted messages that trigger a crash (denial of service). The vulnerabili...

CVE-2016-9577

CVE-2016-9577: SPICE server vulnerability in protocol handling (heap overflow in main_channel_alloc_msg_rcv_buf) allows an authenticated attacker to send crafted messages, potentially crashing or executing code. Affected: SPICE before 0.13.90. References and advisories (Debian, Mageia, IBM) docum...

CVE-2016-0749

CVE-2016-0749 affects SPICE software (remote display system for VMs). The vulnerability stems from the smartcard interaction in SPICE, enabling a remote attacker to cause a heap-based buffer overflow by connecting to a guest VM, potentially crashing the QEMU-KVM host process or executing arbitrar...

CVE-2015-5260

SPICE vulnerability CVE-2015-5260 is a heap-based buffer overflow in SPICE prior to 0.12.6 caused by improper bounds handling of certain QXL commands related to the surface_id parameter. A local attacker could cause a denial of service (heap corruption and QEMU-KVM crash) or possibly execute code...

CVE-2015-3247

CVE-2015-3247 corresponds to a race condition in SPICE (specifically in worker_update_monitors_config within spice-server) that can cause a heap-based memory corruption. The issue allows a remote authenticated guest to crash the host QEMU-KVM process and may potentially enable arbitrary code exec...

CVE-2016-2150

CVE-2016-2150 affects SPICE: a memory access flaw in handling crafted primary surface parameters allows a local guest OS user to read from or write to host memory. Root cause: improper handling of primary surface parameters in SPICE. Impact: confidentiality and integrity of host memory are HIGH, ...

CVE-2013-4282

CVE-2013-4282 – SPICE stack overflow vulnerability Affected: SPICE server components (SPICE 0.12.0 and related packages) where the reds_handle_ticket function in server/reds.c processes SPICE tickets.Root cause: stack-based buffer overflow triggered by a long password in a SPICE ticket.Impact: re...

CVE-2015-5261

CVE-2015-5261 is a heap-based buffer overflow in SPICE before 0.12.6 that allows local guest OS users to read from or write to arbitrary host memory via guest QXL surface-creation parameters. This is a local vulnerability affecting SPICE/QXL components used in virtualized environments. See connec...

CVE-2013-4130

CVE-2013-4130 relates to SPICE, specifically the spice-server in SPICE before 0.12.4. The issue arises from how two functions, red_channel_pipes_add_type and red_channel_pipes_add_empty_msg, handle ring loops, which can be triggered by a network error. This may allow a remote attacker to cause a ...