7 results · Feed
-
High 7.5
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap mem…
-
High 7.5
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer ove…
-
Unscored —
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syst…
-
High 7.6
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames…
-
High 8.3
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages …
-
Unscored —
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control o…
-
Unscored —
The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.