Every CVE Search/ Get API key

CVE-2020-14355

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the...

6.6 MediumFix available

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.69%Down 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-120
Updated
2026-11-02
CVE List No score

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
CVE-2020-14355
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2020-6499 No score

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
EUVD-2020-6499
Updated
2026-11-03
GitHub AdvisoriesGHSA-2457-jhx6-82v4 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the...

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
GHSA-2457-jhx6-82v4
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-120
Updated
2026-11-02
OSVALPINE-CVE-2020-14355 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
ALPINE-CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVBELL-CVE-2020-14355 6.6

CVE-2020-14355 does not affect BellSoft software

Record
BELL-CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
Show 26 moreShow less
OSV 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2020-14355 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
DEBIAN-CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2021-1082 6.6

spice security update

The SPICE package provides the SPICE server library and client. These components are used to provide access to a remote machine's display and devices.

Security Fix(es):

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.(CVE-2020-14355)

Record
OESA-2021-1082
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:4184 6.6

Red Hat Security Advisory: spice and spice-gtk security update

Record
RHSA-2020:4184
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:4185 6.6

Red Hat Security Advisory: spice and spice-gtk security update

Record
RHSA-2020:4185
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:4186 6.6

Red Hat Security Advisory: spice and spice-gtk security update

Record
RHSA-2020:4186
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:4187 6.6

Red Hat Security Advisory: spice and spice-gtk security update

Record
RHSA-2020:4187
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2020-14355 6.6

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Record
UBUNTU-CVE-2020-14355
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVMGASA-2020-0408 No score

Updated spice and spice-gtk packages fix a security vulnerability

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. (CVE-2020-14355)

Record
MGASA-2020-0408
Updated
2026-11-02
OSVopenSUSE-SU-2020:1802-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:1802-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1803-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:1803-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11397-1 No score

libspice-server-devel-0.15.0-1.3 on GA media

These are all security issues fixed in the libspice-server-devel-0.15.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11397-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11398-1 No score

libspice-client-glib-2_0-8-0.39-1.8 on GA media

These are all security issues fixed in the libspice-client-glib-2_0-8-0.39-1.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11398-1
Updated
2026-11-02
OSVSUSE-SU-2020:3070-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).
Record
SUSE-SU-2020:3070-1
Updated
2026-11-02
OSVSUSE-SU-2020:3071-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).
Record
SUSE-SU-2020:3071-1
Updated
2026-11-02
OSVSUSE-SU-2020:3084-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).
Record
SUSE-SU-2020:3084-1
Updated
2026-11-02
OSVSUSE-SU-2020:3085-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding (bsc#1177158).
Record
SUSE-SU-2020:3085-1
Updated
2026-11-02
OSVSUSE-SU-2021:14744-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
  • CVE-2016-2150: Fixed a guest escape using crafted primary surface parameters (bsc#982386)
Record
SUSE-SU-2021:14744-1
Updated
2026-11-02
OSVSUSE-SU-2021:1901-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1901-1
Updated
2026-11-02
OSVSUSE-SU-2021:1902-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1902-1
Updated
2026-11-02
OSVSUSE-SU-2021:1905-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1905-1
Updated
2026-11-02
OSVSUSE-SU-2021:1911-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1911-1
Updated
2026-11-02
OSVSUSE-SU-2021:1928-1 No score

Security update for spice-gtk

This update for spice-gtk fixes the following issues:

  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1928-1
Updated
2026-11-02
OSVSUSE-SU-2021:1956-1 No score

Security update for spice

This update for spice fixes the following issues:

  • CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
  • CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
Record
SUSE-SU-2021:1956-1
Updated
2026-11-02
OSVUSN-4572-1 No score

spice vulnerability

Frediano Ziglio discovered that Spice incorrectly handled QUIC image decoding. A remote attacker could use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4572-1
Updated
2026-11-02
OSVUSN-4572-2 No score

spice vulnerability

USN-4572-1 fixed a vulnerability in Spice. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Frediano Ziglio discovered that Spice incorrectly handled QUIC image decoding. A remote attacker could use this to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4572-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spice
Alpine:v3.15
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.16
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.17
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.18
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.19
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.20
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.21
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.22
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.23
 before 0.15.0-r0
0.15.0-r0
spice
Alpine:v3.24
 before 0.15.0-r0
0.15.0-r0
Show 183 moreShow less
Affected packages
PackageAffectedFixed
spice
Debian:12
 before 0.14.3-2
0.14.3-2
spice
Debian:13
 before 0.14.3-2
0.14.3-2
spice
Debian:14
 before 0.14.3-2
0.14.3-2
spice-gtk
Debian:12
 before 0.39-1
0.39-1
spice-gtk
Debian:13
 before 0.39-1
0.39-1
spice-gtk
Debian:14
 before 0.39-1
0.39-1
spice
Debian:9
 before 0.12.8-2.1+deb9u4, plus listed versions
0.12.8-2.10.12.8-2.1+deb9u10.12.8-2.1+deb9u20.12.8-2.1+deb9u3
0.12.8-2.1+deb9u4
spice-gtk
Debian:9
 before 0.33-3.3+deb9u2, plus listed versions
0.33-3.30.33-3.3+deb9u1
0.33-3.3+deb9u2
spice
Debian:10
 before 0.14.0-1.3+deb10u1, plus listed versions
0.14.0-1.3
0.14.0-1.3+deb10u1
spice
Mageia:7
 before 0.14.2-1.1.mga7
0.14.2-1.1.mga7
spice-gtk
Mageia:7
 before 0.37-1.mga7
0.37-1.mga7
spice
openEuler:20.03-LTS
 before 0.14.3-2.oe1
0.14.3-2.oe1
spice
openEuler:20.03-LTS-SP1
 before 0.14.3-2.oe1
0.14.3-2.oe1
spice
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.14.0-7.el8_0.1
0:0.14.0-7.el8_0.1
spice-debugsource
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.14.0-7.el8_0.1
0:0.14.0-7.el8_0.1
spice-glib
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-glib-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-glib-devel
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk-debugsource
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk-tools
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk-tools-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk3
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk3-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk3-devel
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-gtk3-vala
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.35-7.el8_0.1
0:0.35-7.el8_0.1
spice-server
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.14.0-7.el8_0.1
0:0.14.0-7.el8_0.1
spice-server-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:0.14.0-7.el8_0.1
0:0.14.0-7.el8_0.1
spice
Red Hat:rhel_eus:8.1::appstream
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-glib
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-glib-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-glib-devel
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk-tools
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk-tools-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk3
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk3-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk3-devel
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-gtk3-vala
Red Hat:rhel_eus:8.1::appstream
 before 0:0.37-1.el8_1.2
0:0.37-1.el8_1.2
spice-server
Red Hat:rhel_eus:8.1::appstream
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-server-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-debugsource
Red Hat:rhel_eus:8.1::crb
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-server-debuginfo
Red Hat:rhel_eus:8.1::crb
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice-server-devel
Red Hat:rhel_eus:8.1::crb
 before 0:0.14.2-1.el8_1.1
0:0.14.2-1.el8_1.1
spice
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-glib
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-glib-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-glib-devel
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk-tools
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk3
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk3-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk3-devel
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-gtk3-vala
Red Hat:enterprise_linux:8::appstream
 before 0:0.37-1.el8_2.2
0:0.37-1.el8_2.2
spice-server
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-server-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-server-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice-server-devel
Red Hat:enterprise_linux:8::crb
 before 0:0.14.2-1.el8_2.1
0:0.14.2-1.el8_2.1
spice
Red Hat:enterprise_linux:7::client
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server
Red Hat:enterprise_linux:7::client
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib-devel
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-tools
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-devel
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-vala
Red Hat:enterprise_linux:7::client
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server-devel
Red Hat:enterprise_linux:7::client
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice
Red Hat:enterprise_linux:7::computenode
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-server
Red Hat:enterprise_linux:7::computenode
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-server-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice
Red Hat:enterprise_linux:7::server
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server
Red Hat:enterprise_linux:7::server
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib-devel
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-tools
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-devel
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-vala
Red Hat:enterprise_linux:7::server
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server-devel
Red Hat:enterprise_linux:7::server
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice
Red Hat:enterprise_linux:7::workstation
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server
Red Hat:enterprise_linux:7::workstation
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice-glib-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk-tools
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-gtk3-vala
Red Hat:enterprise_linux:7::workstation
 before 0:0.35-5.el7_9.1
0:0.35-5.el7_9.1
spice-server-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.14.0-9.el7_9.1
0:0.14.0-9.el7_9.1
spice
SUSE:Linux Enterprise Module for Server Applications 15 SP2
 before 0.14.2-3.3.1
0.14.2-3.3.1
spice-gtk
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 0.37-3.3.2
0.37-3.3.2
spice-gtk
SUSE:Linux Enterprise Module for Server Applications 15 SP2
 before 0.37-3.3.2
0.37-3.3.2
spice
SUSE:HPE Helion OpenStack 8
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:OpenStack Cloud 8
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:OpenStack Cloud 9
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:OpenStack Cloud Crowbar 8
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:OpenStack Cloud Crowbar 9
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server 12 SP5
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.12.8-15.1
0.12.8-15.1
spice
SUSE:Enterprise Storage 5
 before 0.12.8-15.1
0.12.8-15.1
spice-gtk
SUSE:HPE Helion OpenStack 8
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:OpenStack Cloud 8
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:OpenStack Cloud 9
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:OpenStack Cloud Crowbar 8
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:OpenStack Cloud Crowbar 9
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server 12 SP5
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.33-3.9.1
0.33-3.9.1
spice-gtk
SUSE:Enterprise Storage 5
 before 0.33-3.9.1
0.33-3.9.1
spice
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 3 CVEs
 before 0.12.4-21.1
0.12.4-21.1
spice
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 2 CVEs
 before 0.14.0-4.9.1
0.14.0-4.9.1
spice
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 2 CVEs
 before 0.14.0-4.9.1
0.14.0-4.9.1
spice
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 2 CVEs
 before 0.14.0-4.9.1
0.14.0-4.9.1
spice
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 2 CVEs
 before 0.14.0-4.9.1
0.14.0-4.9.1
spice
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 2 CVEs
 before 0.12.7-10.12.1
0.12.7-10.12.1
spice-gtk
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 0.31-9.13.1
0.31-9.13.1
spice-gtk
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.34-3.6.1
0.34-3.6.1
spice-gtk
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.34-3.6.1
0.34-3.6.1
spice-gtk
SUSE:Linux Enterprise Server 15-LTSS
 before 0.34-3.6.1
0.34-3.6.1
spice-gtk
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.34-3.6.1
0.34-3.6.1
spice-gtk
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Manager Proxy 4.0
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Manager Retail Branch Server 4.0
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Manager Server 4.0
 before 0.35-3.3.1
0.35-3.3.1
spice-gtk
SUSE:Enterprise Storage 6
 before 0.35-3.3.1
0.35-3.3.1
spice
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Manager Proxy 4.0
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Manager Server 4.0
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 0.14.1-4.3.1
0.14.1-4.3.1
spice
Ubuntu:Pro:14.04:LTS
 before 0.12.4-0nocelt2ubuntu1.8+esm1, plus listed versions
0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu1
Show 8 moreShow less
0.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.30.12.4-0nocelt2ubuntu1.40.12.4-0nocelt2ubuntu1.50.12.4-0nocelt2ubuntu1.60.12.4-0nocelt2ubuntu1.70.12.4-0nocelt2ubuntu1.8
0.12.4-0nocelt2ubuntu1.8+esm1
spice
Ubuntu:16.04:LTS
 before 0.12.6-4ubuntu0.5, plus listed versions
0.12.5-1.1ubuntu20.12.6-40.12.6-4ubuntu0.10.12.6-4ubuntu0.20.12.6-4ubuntu0.30.12.6-4ubuntu0.4
0.12.6-4ubuntu0.5
spice-gtk
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.28-1ubuntu10.29-10.30-1
 None known
spice
Ubuntu:18.04:LTS
 before 0.14.0-1ubuntu2.5, plus listed versions
0.12.8-2.20.14.0-10.14.0-1ubuntu10.14.0-1ubuntu20.14.0-1ubuntu2.10.14.0-1ubuntu2.20.14.0-1ubuntu2.4
0.14.0-1ubuntu2.5
spice-gtk
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.33-3.30.34-1.10.34-1.1build1
 None known
spice
Ubuntu:20.04:LTS
 before 0.14.2-4ubuntu3.1, plus listed versions
0.14.2-0ubuntu20.14.2-4ubuntu10.14.2-4ubuntu20.14.2-4ubuntu3
0.14.2-4ubuntu3.1
spice-gtk
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.37-0ubuntu10.37-0ubuntu20.37-2fakesync1
 None known
spice-gtk
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.39-10.39-30.39-3ubuntu1
 None known
spice-gtk
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.42-20.42-2ubuntu10.42-2ubuntu2
 None known
spice-gtk
Ubuntu:25.10
 All versions, plus listed versions
0.42-2ubuntu20.42-30.42-4
 None known
spice-gtk
Ubuntu:26.10
 All versions, plus listed versions
0.42-4build10.42-4build2
 None known
spice-gtk
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.42-40.42-4build1
 None known
spice
openSUSE:Leap 15.2
 before 0.14.2-lp152.2.3.1
0.14.2-lp152.2.3.1
spice-gtk
openSUSE:Leap 15.2
 before 0.37-lp152.2.3.1
0.37-lp152.2.3.1
spice
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 0.15.0-1.3
0.15.0-1.3
spice-gtk
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.39-1.8
0.39-1.8

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14355 is a medium vulnerability (CVSS 6.6) in Red Hat, Inc. Spice, published October 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 85th percentile. Fixed in spice 0.15.0-r0.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open