Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade spice-glib-develUpgrade spice-protocolUpgrade spice-glibUpgrade spice-gtk-toolsUpgrade spice-gtk-debuginfoUpgrade libgovirt-develUpgrade libgovirtUpgrade spice-gtk3-valaUpgrade spice-gtk3-develUpgrade libgovirt-debuginfoUpgrade spice-gtk3 | Apr 27, 2020 | Sep 11, 2018 |
| Centos_linux | — | Upgrade virt-viewerUpgrade spice-vdagent-debuginfoUpgrade spice-gtk-pythonUpgrade spice-gtk3Upgrade libgovirt-develUpgrade libgovirtUpgrade libgovirt-debuginfoUpgrade spice-gtk-toolsUpgrade spice-gtk3-develUpgrade spice-glibUpgrade spice-gtkUpgrade spice-gtk-develUpgrade spice-gtk3-valaUpgrade virt-viewer-debuginfoUpgrade spice-gtk-debuginfoUpgrade spice-glib-develUpgrade spice-vdagent | Aug 28, 2019 | Sep 11, 2018 |
| Debian | — | Upgrade spice-gtk | Jul 30, 2024 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spice-gtk3Upgrade spice-glib | Jun 17, 2020 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spice-gtk3Upgrade spice-glib | Nov 19, 2019 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spice-gtk3Upgrade spice-glib | Nov 19, 2019 | Sep 11, 2018 |
| Oracle_linux | — | Upgrade spice-gtk3-valaUpgrade spice-gtk-pythonUpgrade spice-glib-develUpgrade spice-gtk3Upgrade spice-vdagentUpgrade spice-gtkUpgrade spice-gtk3-develUpgrade spice-glibUpgrade spice-gtk-toolsUpgrade spice-gtk-develUpgrade libgovirtUpgrade libgovirt-develUpgrade virt-viewer | Feb 12, 2020 | Jun 25, 2018 |
| Redhat_linux | — | Upgrade spice-gtk-pythonUpgrade virt-viewer-debuginfoUpgrade spice-gtkUpgrade spice-glibUpgrade spice-glib-develUpgrade spice-gtk-debuginfoUpgrade virt-viewerNo solution existsUpgrade libgovirt-develUpgrade spice-vdagent-debuginfoUpgrade spice-vdagentUpgrade libgovirt-debuginfoUpgrade spice-gtk3-valaUpgrade spice-gtk3Upgrade spice-gtk-toolsUpgrade spice-gtk-develUpgrade spice-gtk3-develUpgrade libgovirt | Aug 7, 2019 | Sep 11, 2018 |
| Suse | — | Upgrade typelib-1_0-spiceclientgtk-3_0Upgrade spice-gtk-develUpgrade spice-gtkUpgrade libspice-controller0Upgrade spice-gtk-langUpgrade libspice-client-gtk-3_0-5Upgrade libspice-server1Upgrade libspice-client-glib-helperUpgrade libspice-client-glib-2_0-8Upgrade libspice-server-develUpgrade libspice-client-gtk-3_0-4Upgrade libspice-client-gtk-2_0-4Upgrade typelib-1_0-spiceclientglib-2_0 | Aug 31, 2018 | Aug 30, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub