p PatchFirst

CVE-2020-14355

CVE-2020-14355

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

CVSS 6.6 · Medium · EPSS 2.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • spice

    Versions
    • spice-0.14.2-1: Affected

    No fix published

  • spice Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.14.3-2

    Update to 0.14.3-2

  • spice Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.14.3-2

    Update to 0.14.3-2

  • spice Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.14.3-2

    Update to 0.14.3-2

  • spice-gtk Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.39-1

    Update to 0.39-1

  • spice-gtk Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.39-1

    Update to 0.39-1

  • spice-gtk Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.39-1

    Update to 0.39-1

  • spice Ubuntu:Pro:14.04:LTS

    Versions
    • 0.12.4-0nocelt1
    • 0.12.4-0nocelt1.1
    • 0.12.4-0nocelt1.1ubuntu1
    • 0.12.4-0nocelt2
    • 0.12.4-0nocelt2ubuntu1
    • 0.12.4-0nocelt2ubuntu1.1
    • 0.12.4-0nocelt2ubuntu1.2
    • 0.12.4-0nocelt2ubuntu1.3
    • 0.12.4-0nocelt2ubuntu1.4
    • 0.12.4-0nocelt2ubuntu1.5
    • 0.12.4-0nocelt2ubuntu1.6
    • 0.12.4-0nocelt2ubuntu1.7
    • 0.12.4-0nocelt2ubuntu1.8
    Affected ranges
    • ECOSYSTEM: < 0.12.4-0nocelt2ubuntu1.8+esm1

    Update to 0.12.4-0nocelt2ubuntu1.8+esm1

  • spice Ubuntu:16.04:LTS

    Versions
    • 0.12.5-1.1ubuntu2
    • 0.12.6-4
    • 0.12.6-4ubuntu0.1
    • 0.12.6-4ubuntu0.2
    • 0.12.6-4ubuntu0.3
    • 0.12.6-4ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 0.12.6-4ubuntu0.5

    Update to 0.12.6-4ubuntu0.5

  • spice-gtk Ubuntu:16.04:LTS

    Versions
    • 0.28-1ubuntu1
    • 0.29-1
    • 0.30-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice Ubuntu:18.04:LTS

    Versions
    • 0.12.8-2.2
    • 0.14.0-1
    • 0.14.0-1ubuntu1
    • 0.14.0-1ubuntu2
    • 0.14.0-1ubuntu2.1
    • 0.14.0-1ubuntu2.2
    • 0.14.0-1ubuntu2.4
    Affected ranges
    • ECOSYSTEM: < 0.14.0-1ubuntu2.5

    Update to 0.14.0-1ubuntu2.5

  • spice-gtk Ubuntu:18.04:LTS

    Versions
    • 0.33-3.3
    • 0.34-1.1
    • 0.34-1.1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice Ubuntu:20.04:LTS

    Versions
    • 0.14.2-0ubuntu2
    • 0.14.2-4ubuntu1
    • 0.14.2-4ubuntu2
    • 0.14.2-4ubuntu3
    Affected ranges
    • ECOSYSTEM: < 0.14.2-4ubuntu3.1

    Update to 0.14.2-4ubuntu3.1

  • spice-gtk Ubuntu:20.04:LTS

    Versions
    • 0.37-0ubuntu1
    • 0.37-0ubuntu2
    • 0.37-2fakesync1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice-gtk Ubuntu:22.04:LTS

    Versions
    • 0.39-1
    • 0.39-3
    • 0.39-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice-gtk Ubuntu:24.04:LTS

    Versions
    • 0.42-2
    • 0.42-2ubuntu1
    • 0.42-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice-gtk Ubuntu:25.10

    Versions
    • 0.42-2ubuntu2
    • 0.42-3
    • 0.42-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice-gtk Ubuntu:26.10

    Versions
    • 0.42-4build1
    • 0.42-4build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spice-gtk Ubuntu:26.04:LTS

    Versions
    • 0.42-4
    • 0.42-4build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →