https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T10:22:05.359968+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2021:1791 ALSA-2021:1791 — Moderate: spice-vdagent security and bug fix update 2026-10-10T10:22:05.504083+00:00

Affected: AlmaLinux:8: spice-vdagent

The spice-vdagent packages provide a SPICE agent for Linux guests.

Security Fix(es):

* spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map (CVE-2020-25651)

* spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (CVE-2020-25653)

* spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table (CVE-2020-25650)

* spice-vdagent: possibility to exhaust file descriptors in vdagentd (CVE-2020-25652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-45694 EUVD-2026-45694 2026-10-10T10:22:05.504147+00:00 EUVD-2026-45694 https://cve.radiocsirt.org/vuln/fkie_cve-2020-25653 fkie_cve-2020-25653 2026-10-10T10:22:05.504163+00:00

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

 https://cve.radiocsirt.org/vuln/ghsa-5v7v-8wfp-pqqp GHSA-5v7v-8wfp-pqqp 2026-10-10T10:22:05.504187+00:00

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

 https://cve.radiocsirt.org/vuln/gsd-2020-25653 gsd-2020-25653 2026-10-10T10:22:05.504203+00:00 gsd-2020-25653 https://cve.radiocsirt.org/vuln/msrc_cve-2020-25653 msrc_CVE-2020-25653 — A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw… 2026-10-10T10:22:05.504213+00:00 msrc_CVE-2020-25653 https://cve.radiocsirt.org/vuln/oesa-2021-1081 OESA-2021-1081 — spice-vdagent security update 2026-10-10T10:22:05.504231+00:00

Affected: openEuler:20.03-LTS: spice-vdagent, openEuler:20.03-LTS-SP1: spice-vdagent

spice-vdagent is an optional component for enhancing user experience and performing guest-oriented management tasks. Its features includes: client mouse mode (no need to grab mouse by client, no mouse lag), automatic adjustment of screen resolution, copy and paste (text and image) between client and domU. It also requires vdagent service installed on domU o.s. to work. The default is 0. Security Fix(es): A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25653) A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25652) A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual…

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:2614-1 openSUSE-SU-2021:2614-1 — Security update for spice-vdagent 2026-10-10T10:22:05.504269+00:00

Security update for spice-vdagent

 https://cve.radiocsirt.org/vuln/suse-su-2020:3268-1 SUSE-SU-2020:3268-1 — Security update for spice-vdagent 2026-10-10T10:22:05.504286+00:00

Security update for spice-vdagent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-25653 UBUNTU-CVE-2020-25653 2026-10-10T10:22:05.504301+00:00

Affected: Ubuntu:16.04:LTS: spice-vdagent, Ubuntu:18.04:LTS: spice-vdagent, Ubuntu:20.04:LTS: spice-vdagent

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.