CVE-2020-25651
Summary
| CVE | CVE-2020-25651 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-11-26 02:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 32 Update: spice-vdagent-0.21.0-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: spice-vdagent-0.21.0-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| oss-security - Security Issues in the spice-vdagentd daemon |
MISC |
www.openwall.com |
Exploit, Mailing List, Third Party Advisory |
| [SECURITY] Fedora 33 Update: spice-vdagent-0.21.0-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Third Party Advisory |
| [SECURITY] Fedora 32 Update: spice-vdagent-0.21.0-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Third Party Advisory |
| 1886359 – (CVE-2020-25651) CVE-2020-25651 spice-vdagent: possible file transfer DoS and information leak via `active_xfers` hash map |
MISC |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| [SECURITY] [DLA 2524-1] spice-vdagent security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159216 Oracle Enterprise Linux Security Update for spice-vdagent (ELSA-2021-1791)
- 239302 Red Hat Update for spice-vdagent (RHSA-2021:1791)
- 377381 Alibaba Cloud Linux Security Update for spice-vdagent (ALINUX3-SA-2022:0084)
- 670499 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2257)
- 670525 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2283)
- 670557 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2316)
- 670592 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2350)
- 670694 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2452)
- 670962 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2617)
- 750925 OpenSUSE Security Update for spice-vdagent (openSUSE-SU-2021:2614-1)
- 750974 SUSE Enterprise Linux Security Update for spice-vdagent (SUSE-SU-2021:2766-1)
- 750989 SUSE Enterprise Linux Security Update for spice-vdagent (SUSE-SU-2021:2803-1)
- 901686 Common Base Linux Mariner (CBL-Mariner) Security Update for spice-vdagent (7363-1)
- 940204 AlmaLinux Security Update for spice-vdagent (ALSA-2021:1791)
- 960751 Rocky Linux Security Update for spice-vdagent (RLSA-2021:1791)
