Read the docs

Spice-space

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Spice-space records in CISA KEV

No Spice-space vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Spice-vdagent 7 records LOW Spice-server 1 record HIGH Usbredir 1 record LOW

Records

7 records in Spice-vdagent · all components

TI-2017-11081 CVE-2017-15108 · GHSA-rx22-vq3w-89rg

OS command injection in Red Hat spice-vdagent

Priority LOW 34

spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00419 Published 2018-01-20 Will not fix CWE-78
TI-2020-15670 CVE-2020-25653 · GHSA-5v7v-8wfp-pqqp

Race condition in spice-vdagent

Priority LOW 28

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.0033 Published 2020-11-26 Partial fix CWE-362
TI-2020-15668 CVE-2020-25651 · GHSA-gjj5-vggp-jg8p

Race condition in spice-vdagent

Priority LOW 28

A flaw was found in the SPICE file transfer protocol.

CVSS 3.1MEDIUM 6.4 Local Low privileges No interaction EPSS 0.00299 Published 2020-11-26 Partial fix CWE-362
TI-2020-15669 CVE-2020-25652 · GHSA-6rmh-mmff-jmfj

Resource allocation without limits in spice-vdagent

Priority LOW 25

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00436 Published 2020-11-26 Partial fix CWE-770
TI-2020-15667 CVE-2020-25650 · GHSA-f637-jpfq-3wv2

Resource allocation without limits in spice-vdagent

Priority LOW 25

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.005 Published 2020-11-25 Partial fix CWE-770
Open these records in search →