CVE catalog

CVE-2020-25650

spice-vdagent: CVE-2020-25650

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.50% · Oct 25, 2026

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspice-vdagentsid0.23.0-4fixed
Debianspice-vdagentforky0.23.0-4fixed
Debianspice-vdagenttrixie0.22.1-4.1fixed
Debianspice-vdagentbookworm0.22.1-3fixed
Debianspice-vdagentbookworm-security0.22.1-3+deb12u1fixed
Ubuntuspice-vdagent18.040.17.0-1ubuntu1vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2.2fixed
Ubuntuspice-vdagent20.040.19.0-2vulnerable
Ubuntuspice-vdagent20.040.19.0-2ubuntu0.2fixed
Susespice-vdagentlinux enterprise module for desktop applications 15 sp30.21.0-3.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15-espos0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15-ltss0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp1-espos0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp1-ltss0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise server 15-ltss0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise server 15 sp1-bcl0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise server 15 sp1-ltss0.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 150.17.0-4.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 15 sp10.17.0-4.3.1fixed
Susespice-vdagentmanager proxy 4.00.17.0-4.3.1fixed
Susespice-vdagentmanager retail branch server 4.00.17.0-4.3.1fixed
Susespice-vdagentmanager server 4.00.17.0-4.3.1fixed
Susespice-vdagententerprise storage 60.17.0-4.3.1fixed
Opensusespice-vdagentleap 15.30.21.0-3.3.1fixed
Susespice-vdagentlinux enterprise module for desktop applications 15 sp20.19.0-3.3.1fixed
Susespice-vdagentlinux enterprise server 12 sp50.16.0-8.8.2fixed
Susespice-vdagentlinux enterprise server for sap applications 12 sp50.16.0-8.8.2fixed
Ubuntuspice-vdagent16.040.15.0-1.3vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu1vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2.2fixed
Ubuntuspice-vdagent20.040.19.0-2vulnerable
Ubuntuspice-vdagent20.040.19.0-2ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspice-vdagentsourcesid0.20.0-2not yet assignedNot reported[973769]
Debianspice-vdagentsourceforky0.20.0-2not yet assignedNot reported[973769]
Debianspice-vdagentsourcetrixie0.20.0-2not yet assignedNot reported[973769]
Debianspice-vdagentsourcebookworm0.20.0-2not yet assignedNot reported[973769]
Ubuntuspice-vdagentdeb18.040.17.0-1ubuntu2.2Not reportedUSN-4617-1Not reported
Ubuntuspice-vdagentdeb20.040.19.0-2ubuntu0.2Not reportedUSN-4617-1Not reported
Susespice-vdagentrpmlinux enterprise module for desktop applications 15 sp30.21.0-3.3.1Not reportedSUSE-SU-2021:2614-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15-espos0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15-ltss0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp1-espos0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp1-ltss0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise server 15-ltss0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise server 15 sp1-bcl0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise server 15 sp1-ltss0.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 150.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 15 sp10.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmmanager proxy 4.00.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmmanager retail branch server 4.00.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmmanager server 4.00.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Susespice-vdagentrpmenterprise storage 60.17.0-4.3.1Not reportedSUSE-SU-2021:2803-1Not reported
Opensusespice-vdagentrpmleap 15.30.21.0-3.3.1Not reportedOPENSUSE-SU-2021:2614-1Not reported
Susespice-vdagentrpmlinux enterprise module for desktop applications 15 sp20.19.0-3.3.1Not reportedSUSE-SU-2020:3268-1Not reported
Susespice-vdagentrpmlinux enterprise server 12 sp50.16.0-8.8.2Not reportedSUSE-SU-2021:2766-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 12 sp50.16.0-8.8.2Not reportedSUSE-SU-2021:2766-1Not reported
Ubuntuspice-vdagentdeb18.040.17.0-1ubuntu2.2Not reportedUBUNTU-CVE-2020-25650Not reported
Ubuntuspice-vdagentdeb20.040.19.0-2ubuntu0.2Not reportedUBUNTU-CVE-2020-25650Not reported

[Debian bug #973769]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [spice-vdagent]Fixed
    Details (4)

    • 0.22.1-3+b2 · amd64 · bookworm

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · bookworm; dsa · spice-vdagent · debian · 12

    • 0.22.1-3+b2 · arm64 · bookworm

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · bookworm; dsa · spice-vdagent · debian · 12

    • 0.22.1-3+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · bookworm; dsa · spice-vdagent · debian · 12

    • 0.22.1-3+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · bookworm; dsa · spice-vdagent · debian · 12

[Debian 13 (Trixie)]

  • [spice-vdagent]Fixed
    Details (2)

    • 0.22.1-4.1 · amd64 · trixie

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · 13

    • 0.22.1-4.1 · arm64 · trixie

      Fixed · Fixed: 0.20.0-2

      dsa · spice-vdagent · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]