CVE-2020-14355: Buffer Overflow
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
Other sources
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. More specifically, these flaws reside in the spice-common shared code between the client and server of SPICE. In other words, both the client (spice-gtk) and server are affected by these flaws. A malicious client or server could send specially crafted messages which would result in a process crash or potential code execution.
Upstream commits: https://gitlab.freedesktop.org/spice/spice-common/-/commit/762e0aba https://gitlab.freedesktop.org/spice/spice-common/-/commit/404d7478 https://gitlab.freedesktop.org/spice/spice-common/-/commit/ef1b6ff7 https://gitlab.freedesktop.org/spice/spice-common/-/commit/b24fe6b6
— Red Hat