CVE-2020-14355

Summary of CVE-2020-14355 : Multiple buffer overflow vulnerabilities were found in the QUIC image decoding path of SPICE, affecting both client and server components (spice-gtk, spice-server, and shared spice-common code). The flaws could allow a remote attacker to send crafted QUIC messages that...

CVE-2021-20201

The CVE-2021-20201 issue affects SPICE, specifically the SPICE server prior to version 0.15.0. A denial-of-service condition exists where an attacker can trigger high CPU usage by performing many renegotiations within a single connection. Arch Linux advisory confirms the remediation is upgrading ...

CVE-2018-10873

CVE-2018-10873 affects SPICE before 0.14.1: a missing bounds check in demarshal.py:write_validate_array_item can be exploited by an authenticated remote peer to crash the SPICE client/server. Public advisories (Debian, IBM, Mageia/CentOS) describe denial of service and potential code execution im...

CVE-2016-9578

CVE-2016-9578 affects SPICE prior to 0.13.90 in the server’s protocol handling. The issue is caused by the server’s improper validation of incoming messages, allowing an attacker who can connect to the SPICE server to send crafted messages that trigger a crash (denial of service). The vulnerabili...

CVE-2016-9577

CVE-2016-9577: SPICE server vulnerability in protocol handling (heap overflow in main_channel_alloc_msg_rcv_buf) allows an authenticated attacker to send crafted messages, potentially crashing or executing code. Affected: SPICE before 0.13.90. References and advisories (Debian, Mageia, IBM) docum...