Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. 1868435: CVE-2020-14355 spice: multiple buffer overflow vulnerabilities in QUIC decoding code
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | spice-glib | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-glib-devel | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-gtk-debuginfo | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-gtk-tools | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-gtk3 | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-gtk3-devel | 0:0.35-5.amzn2.1 |
| Amazon Linux · 2 | spice-gtk3-vala | 0:0.35-5.amzn2.1 |
Vulnerabilities 1
-
Unscored —
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syst…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-14355.html