6.6

CVE-2020-14355

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Spice Project ≫ Spice Version < 0.14.2
Redhat ≫ Openstack Version 16.1
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 20.04 SwEdition lts
Debian ≫ Debian Linux Version 9.0
Opensuse ≫ Leap Version 15.2
Redhat ≫ Enterprise Linux Version 6.0
Redhat ≫ Enterprise Linux Version 7.0
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Aus Version 8.2
Redhat ≫ Enterprise Linux Eus Version 8.1
Redhat ≫ Enterprise Linux Tus Version 8.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.66% 0.838
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.6 2.3 3.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.html
Third Party Advisory
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1868435
Patch
Vendor Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2020/11/msg00001.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2020/11/msg00002.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4572-1/
Third Party Advisory
https://usn.ubuntu.com/4572-2/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4771
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/10/06/10
Patch
Third Party Advisory
Mailing List