Most recent entries from all

ALSA-2021:1791 — Moderate: spice-vdagent security and bug fix update

Affected: AlmaLinux:8: spice-vdagent

The spice-vdagent packages provide a SPICE agent for Linux guests.

Security Fix(es):

* spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map (CVE-2020-25651)

* spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (CVE-2020-25653)

* spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table (CVE-2020-25650)

* spice-vdagent: possibility to exhaust file descriptors in vdagentd (CVE-2020-25652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

EUVD-2026-45690

fkie_cve-2020-25650

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

GHSA-f637-jpfq-3wv2

gsd-2020-25650

msrc_CVE-2020-25650 — A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machin…

msrc_CVE-2020-25650

OESA-2021-1081 — spice-vdagent security update

Affected: openEuler:20.03-LTS: spice-vdagent, openEuler:20.03-LTS-SP1: spice-vdagent

spice-vdagent is an optional component for enhancing user experience and performing guest-oriented management tasks. Its features includes: client mouse mode (no need to grab mouse by client, no mouse lag), automatic adjustment of screen resolution, copy and paste (text and image) between client and domU. It also requires vdagent service installed on domU o.s. to work. The default is 0. Security Fix(es): A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25653) A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25652) A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual…

openSUSE-SU-2021:2614-1 — Security update for spice-vdagent

Security update for spice-vdagent

SUSE-SU-2020:3268-1 — Security update for spice-vdagent

Security update for spice-vdagent

UBUNTU-CVE-2020-25650

Affected: Ubuntu:16.04:LTS: spice-vdagent, Ubuntu:18.04:LTS: spice-vdagent, Ubuntu:20.04:LTS: spice-vdagent