FS#68166 - [security][spice][spice-gtk] CVE-2020-14355

Attached to Project: Arch Linux
Opened by loqs (loqs) - Friday, 09 October 2020, 10:57 GMT
Last edited by Jonas Witschel (diabonas) - Monday, 05 July 2021, 08:02 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To Tobias Powalowski (tpowa)
Levente Polyak (anthraxx)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
The four commits can be applied cleanly to both projects [1][2].

Additional info:
* spice 0.14.3-2
* spice-gtk 0.38-1
* https://gitlab.freedesktop.org/spice/spice-common/-/commit/762e0abae36033ccde658fd52d3235887b60862d
* https://gitlab.freedesktop.org/spice/spice-common/-/commit/404d74782c8b5e57d146c5bf3118bb41bf3378e4
* https://gitlab.freedesktop.org/spice/spice-common/-/commit/ef1b6ff7b82e15d759e5415b8e35b92bb1a4c206
* https://gitlab.freedesktop.org/spice/spice-common/-/commit/b24fe6b66b86e601c725d30f00c37e684b6395b6
* https://www.openwall.com/lists/oss-security/2020/10/06/10
[1] PKGBUILD.spice.diff
[2] PKGBUILD.spice-gtk.diff
   PKGBUILD.spice.diff (4.1 KiB)
   PKGBUILD.spice-gtk.diff (4.1 KiB)
This task depends upon

Closed by  Jonas Witschel (diabonas)
Monday, 05 July 2021, 08:02 GMT
Reason for closing:  Fixed
Additional comments about closing:  CVE-2020-14355 and CVE-2021-20201 are fixed in spice 0.15.0-1 in [extra]
Comment by Jonas Witschel (diabonas) - Thursday, 28 January 2021, 17:46 GMT
Another security issue (https://security.archlinux.org/CVE-2021-20201) has been found in spice, which is mitigated by the following two commits:

https://gitlab.freedesktop.org/spice/spice/-/commit/95a0cfac8a1c8eff50f05e65df945da3bb501fc9
https://gitlab.freedesktop.org/spice/spice/-/commit/ca5bbc5692e052159bce1a75f55dc60b36078749

Loading...