CVEvulnerability

CVE-2020-25651

6.4 MEDIUM Published 2020-11-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS 2.0 ([email protected])
3.3 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:P
Weaknesses
CWE-362

Description

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Affected configurations

• spice-space spice-vdagent (<= 0.20.0) • debian debian linux 9.0 • fedoraproject fedora 32 • fedoraproject fedora 33

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References