Arch Linux

Please read this before reporting a bug:

Do NOT report bugs when a package is just outdated, or it is in Unsupported. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#68166 - [security][spice][spice-gtk] CVE-2020-14355

Attached to Project: Arch Linux
Opened by loqs (loqs) - Friday, 09 October 2020, 10:57 GMT
Last edited by freswa (frederik) - Friday, 09 October 2020, 12:15 GMT
Task Type Bug Report
Category Security
Status Assigned
Assigned To Tobias Powalowski (tpowa)
Levente Polyak (anthraxx)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 0%
Votes 0
Private No


Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
The four commits can be applied cleanly to both projects [1][2].

Additional info:
* spice 0.14.3-2
* spice-gtk 0.38-1
[1] PKGBUILD.spice.diff
[2] PKGBUILD.spice-gtk.diff
This task depends upon