Vulnerabilities > Spice Space

DATE CVE VULNERABILITY TITLE RISK
2023-08-22 CVE-2020-23793 Missing Authorization vulnerability in Spice-Space Spice-Server 0.14.06El76.1
An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product.
network
low complexity
spice-space CWE-862
8.6
8.6
2022-02-24 CVE-2021-3700 Use After Free vulnerability in multiple products
A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. 		6.4
6.4
2020-11-26 CVE-2020-25653 Race Condition vulnerability in multiple products
A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections.
local
high complexity
spice-space debian fedoraproject CWE-362
6.3
6.3
2020-11-26 CVE-2020-25652 A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`.
local
low complexity
spice-space debian fedoraproject
5.5
5.5
2020-11-26 CVE-2020-25651 A flaw was found in the SPICE file transfer protocol.
local
high complexity
spice-space debian fedoraproject
6.4
6.4
2020-11-25 CVE-2020-25650 A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.
local
low complexity
spice-space debian fedoraproject
5.5
5.5
2018-01-20 CVE-2017-15108 spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.
local
low complexity
spice-space debian
7.8
7.8