Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 7.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade spice-gtk-debuginfoUpgrade spice-glib-develUpgrade spice-protocolUpgrade spice-gtk-toolsUpgrade spice-glibUpgrade libgovirt-develUpgrade libgovirtUpgrade libgovirt-debuginfoUpgrade spice-gtk3-valaUpgrade spice-gtk3-develUpgrade spice-gtk3 | Apr 27, 2020 | Sep 11, 2018 |
| Centos_linux | — | Upgrade spice-gtk-toolsUpgrade virt-viewer-debuginfoUpgrade spice-glib-develUpgrade spice-vdagentUpgrade spice-gtk3-valaUpgrade spice-glibUpgrade spice-gtkUpgrade spice-gtk3-develUpgrade spice-gtk-debuginfoUpgrade spice-gtk-develUpgrade spice-gtk-pythonUpgrade libgovirtUpgrade spice-vdagent-debuginfoUpgrade virt-viewerUpgrade libgovirt-develUpgrade spice-gtk3Upgrade libgovirt-debuginfo | Aug 28, 2019 | Sep 11, 2018 |
| Debian | — | Upgrade spice-gtk | Jul 30, 2024 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spice-glibUpgrade spice-gtk3 | Jun 17, 2020 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spice-glibUpgrade spice-gtk3 | Nov 19, 2019 | Sep 11, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spice-glibUpgrade spice-gtk3 | Nov 19, 2019 | Sep 11, 2018 |
| Oracle_linux | — | Upgrade spice-gtk-develUpgrade spice-vdagentUpgrade spice-gtk3-develUpgrade spice-gtk3-valaUpgrade spice-gtk-pythonUpgrade spice-glib-develUpgrade spice-gtk-toolsUpgrade spice-gtkUpgrade spice-glibUpgrade spice-gtk3Upgrade virt-viewerUpgrade libgovirt-develUpgrade libgovirt | Feb 12, 2020 | Jun 25, 2018 |
| Redhat_linux | — | Upgrade spice-gtk3Upgrade spice-gtk3-valaUpgrade libgovirt-debuginfoUpgrade spice-gtk-toolsUpgrade spice-gtk-develUpgrade spice-gtk3-develUpgrade libgovirtUpgrade spice-vdagentUpgrade virt-viewer-debuginfoUpgrade spice-gtk-debuginfoUpgrade spice-vdagent-debuginfoUpgrade virt-viewerUpgrade libgovirt-develUpgrade spice-gtkUpgrade spice-glibUpgrade spice-gtk-pythonNo solution existsUpgrade spice-glib-devel | Aug 7, 2019 | Sep 11, 2018 |
| Suse | — | Upgrade typelib-1_0-SpiceClientGtk-3_0Upgrade libspice-client-gtk-2_0-4Upgrade libspice-client-gtk-3_0-5Upgrade libspice-server-develUpgrade libspice-client-glib-helperUpgrade libspice-server1Upgrade typelib-1_0-SpiceClientGlib-2_0Upgrade libspice-client-glib-2_0-8Upgrade libspice-client-gtk-3_0-4Upgrade spice-gtkUpgrade spice-gtk-langUpgrade spice-gtk-develUpgrade libspice-controller0 | Aug 31, 2018 | Aug 30, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub