Buffer overflow in spice
Priority LOW 34CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 12 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
Why it matters now
EPSS 0.02689 85th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 12 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | spice | spice-0.14.2-1 | — | No fix listed | CNA |
- spice Vendor— Affected spice-0.14.2-1 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:* | before 0.14.2 | Vulnerable | The SPICE Project |
| cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:* Versions before 0.14.2 Vulnerable ·The SPICE Project
- cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
Red Hat 4 advisories
- RHSA-2020:4187 Released 2020-10-06 · Red Hat rating Importantspice and spice-gtk security update
- Red Hat Enterprise Linux Client (v. 7) spice-0.14.0-9.el7_9.1, spice-glib-0.35-5.el7_9.1, spice-gtk-0.35-5.el7_9.1 +2
- Red Hat Enterprise Linux Client Optional (v. 7) spice-glib-devel-0.35-5.el7_9.1, spice-gtk-tools-0.35-5.el7_9.1, spice-gtk3-devel-0.35-5.el7_9.1 +2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) spice-0.14.0-9.el7_9.1, spice-server-0.14.0-9.el7_9.1, spice-server-devel-0.14.0-9.el7_9.1
- Red Hat Enterprise Linux Server (v. 7) spice-0.14.0-9.el7_9.1, spice-glib-0.35-5.el7_9.1, spice-gtk-0.35-5.el7_9.1 +2
- Red Hat Enterprise Linux Server Optional (v. 7) spice-glib-0.35-5.el7_9.1, spice-glib-devel-0.35-5.el7_9.1, spice-gtk-0.35-5.el7_9.1 +5
- Red Hat Enterprise Linux Workstation (v. 7) spice-0.14.0-9.el7_9.1, spice-glib-0.35-5.el7_9.1, spice-gtk-0.35-5.el7_9.1 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) spice-glib-devel-0.35-5.el7_9.1, spice-gtk-tools-0.35-5.el7_9.1, spice-gtk3-devel-0.35-5.el7_9.1 +2
- RHSA-2020:4186 Released 2020-10-06 · Red Hat rating Importantspice and spice-gtk security update
- Red Hat CodeReady Linux Builder (v. 8) spice-server-devel-0.14.2-1.el8_2.1
- Red Hat Enterprise Linux AppStream (v. 8) spice-0.14.2-1.el8_2.1, spice-glib-0.37-1.el8_2.2, spice-glib-devel-0.37-1.el8_2.2 +6
- RHSA-2020:4185 Released 2020-10-06 · Red Hat rating Importantspice and spice-gtk security update
- Red Hat CodeReady Linux Builder EUS (v. 8.1) spice-server-devel-0.14.2-1.el8_1.1
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) spice-0.14.2-1.el8_1.1, spice-glib-0.37-1.el8_1.2, spice-glib-devel-0.37-1.el8_1.2 +6
Show 1 more Red Hat advisories
- RHSA-2020:4184 Released 2020-10-06 · Red Hat rating Importantspice and spice-gtk security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) spice-0.14.0-7.el8_0.1, spice-glib-0.35-7.el8_0.1, spice-glib-devel-0.35-7.el8_0.1 +6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2020:4186 |
| Red Hat CodeReady Linux Builder EUS (v. 8.1) | Fixed | RHSA-2020:4185 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4186 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:4184 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2020:4185 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4187 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4187 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14355
- 2026-10-03 Alias added: GHSA-2457-jhx6-82v4
References
Patch 2
Sources
- CVE-2020-14355 · CVE Program
- CVE-2020-14355 · NVD
- FIRST EPSS
- GHSA-2457-jhx6-82v4 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-14355 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences