PatchTheCVEspice vulnerabilities and fixes
Recent CVEs affecting spice, with upgrade or downgrade steps. 11 tracked.
spice has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2021-05-28. Highest priority: CVE-2018-10873 (score 57/100).
- CVE-2021-20201 MEDIUM 5.3 UPGRADE MITIGATE A flaw was found in spice in versions before 0.14.92
- CVE-2020-14355 MEDIUM 6.6 UPGRADE DOWNGRADE Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote dis
- CVE-2019-3813 HIGH 7.5 UPGRADE MITIGATE Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in me
- CVE-2018-10893 HIGH 7.6 MITIGATE Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compress
- CVE-2018-10873 HIGH 8.3 UPGRADE MITIGATE A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling
- CVE-2017-7506 HIGH 8.8 DOWNGRADE spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted mes
- CVE-2016-9578 HIGH 7.5 UPGRADE MITIGATE A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling
- CVE-2016-9577 HIGH 7.5 UPGRADE MITIGATE A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling
- CVE-2015-3247 MEDIUM 6.9 DOWNGRADE MITIGATE Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated gue
- CVE-2013-4282 MEDIUM 5.0 DOWNGRADE DOWNGRADE Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote
- CVE-2013-4130 MEDIUM 5.0 UPGRADE MITIGATE The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c i
FAQ
How do I fix spice vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spice being exploited right now?
None of the tracked spice CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spice CVE should I patch first?
CVE-2018-10873 currently ranks highest (57/100): A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling .