CVE-2020-25651

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

• CWE-362
• CWE-362

• https://bugzilla.redhat.com/show_bug.cgi?id=1886359Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIWJ2EIQXWEA2VDBODEATHAT37X4CREP/
• https://www.openwall.com/lists/oss-security/2020/11/04/1Exploit, Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1886359Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIWJ2EIQXWEA2VDBODEATHAT37X4CREP/
• https://www.openwall.com/lists/oss-security/2020/11/04/1Exploit, Mailing List, Third Party Advisory

Published

Nov 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25646A flaw was found in Ansible Collection community.crypto. ope…7.5
• CVE-2020-25647A flaw was found in grub2 in versions prior to 2.06. During …7.6
• CVE-2020-25648A flaw was found in the way NSS handled CCS (ChangeCipherSpe…7.5
• CVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did…7.5
• CVE-2020-2565Vulnerability in the Oracle Solaris product of Oracle System…7.5
• CVE-2020-25650A flaw was found in the way the spice-vdagentd daemon handle…5.5
• CVE-2020-25652A flaw was found in the spice-vdagentd daemon, where it did …5.5
• CVE-2020-25653A race condition vulnerability was found in the way the spic…6.3
• CVE-2020-25654An ACL bypass flaw was found in pacemaker. An attacker havin…7.2
• CVE-2020-25655An issue was discovered in ManagedClusterView API, that coul…6.5
• CVE-2020-25656A flaw was found in the Linux kernel. A use-after-free was f…4.1
• CVE-2020-25657A flaw was found in all released versions of m2crypto, where…5.9