Medium severity6.6NVD Advisory· Published Oct 7, 2020· Updated Jun 17, 2026

CVE-2020-14355

Description

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Openstack
cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*
Spice Project/Spice
cpe:2.3:a:spice_project:spice:*:*:*:*:*:*:*:*
Range: <0.14.2
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server5 versions
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Update Services For Sap Solutions
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*
SPICE/SPICE remote display systemdescription
Spice Project/SPICE remote display systemllm-create
Range: <0.14.2-1
Spice Gtk/spice-gtkllm-fuzzy
Range: <0.14.2-1
osv-coords64 versions
pkg:rpm/opensuse/spice&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/spice&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/spice-gtk&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/spice-gtk&distro=openSUSE%20Tumbleweed pkg:rpm/suse/spice&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/spice&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/spice&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/spice&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/spice&distro=SUSE%20Manager%20Proxy%204.0 pkg:rpm/suse/spice&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0 pkg:rpm/suse/spice&distro=SUSE%20Manager%20Server%204.0 pkg:rpm/suse/spice&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/spice&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/spice&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/spice&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/spice-gtk&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/spice-gtk&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/spice-gtk&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/spice-gtk&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/spice-gtk&distro=SUSE%20Manager%20Proxy%204.0 pkg:rpm/suse/spice-gtk&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0 pkg:rpm/suse/spice-gtk&distro=SUSE%20Manager%20Server%204.0 pkg:rpm/suse/spice-gtk&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/spice-gtk&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/spice-gtk&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/spice-gtk&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
< 0.14.2-lp152.2.3.1+ 63 more
- (no CPE)range: < 0.14.2-lp152.2.3.1
- (no CPE)range: < 0.15.0-1.3
- (no CPE)range: < 0.37-lp152.2.3.1
- (no CPE)range: < 0.39-1.8
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.0-4.9.1
- (no CPE)range: < 0.14.0-4.9.1
- (no CPE)range: < 0.14.2-3.3.1
- (no CPE)range: < 0.12.4-21.1
- (no CPE)range: < 0.12.7-10.12.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.0-4.9.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.14.0-4.9.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.14.1-4.3.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.12.8-15.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.34-3.6.1
- (no CPE)range: < 0.34-3.6.1
- (no CPE)range: < 0.37-3.3.2
- (no CPE)range: < 0.37-3.3.2
- (no CPE)range: < 0.31-9.13.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.34-3.6.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.34-3.6.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.35-3.3.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1
- (no CPE)range: < 0.33-3.9.1

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchVendor Advisory
www.openwall.com/lists/oss-security/2020/10/06/10nvdMailing ListPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2020/11/msg00001.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2020/11/msg00002.htmlnvdMailing ListThird Party Advisory
usn.ubuntu.com/4572-1/nvdThird Party Advisory
usn.ubuntu.com/4572-2/nvdThird Party Advisory
www.debian.org/security/2020/dsa-4771nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.429
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000