CVE-2020-25653

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

• CWE-362
• CWE-362

• https://bugzilla.redhat.com/show_bug.cgi?id=1886372Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIWJ2EIQXWEA2VDBODEATHAT37X4CREP/
• https://www.openwall.com/lists/oss-security/2020/11/04/1Exploit, Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1886372Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/01/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIWJ2EIQXWEA2VDBODEATHAT37X4CREP/
• https://www.openwall.com/lists/oss-security/2020/11/04/1Exploit, Mailing List, Third Party Advisory

Published

Nov 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25648A flaw was found in the way NSS handled CCS (ChangeCipherSpe…7.5
• CVE-2020-25649A flaw was found in FasterXML Jackson Databind, where it did…7.5
• CVE-2020-2565Vulnerability in the Oracle Solaris product of Oracle System…7.5
• CVE-2020-25650A flaw was found in the way the spice-vdagentd daemon handle…5.5
• CVE-2020-25651A flaw was found in the SPICE file transfer protocol. File d…6.4
• CVE-2020-25652A flaw was found in the spice-vdagentd daemon, where it did …5.5
• CVE-2020-25654An ACL bypass flaw was found in pacemaker. An attacker havin…7.2
• CVE-2020-25655An issue was discovered in ManagedClusterView API, that coul…6.5
• CVE-2020-25656A flaw was found in the Linux kernel. A use-after-free was f…4.1
• CVE-2020-25657A flaw was found in all released versions of m2crypto, where…5.9
• CVE-2020-25658It was found that python-rsa is vulnerable to Bleichenbacher…5.9
• CVE-2020-25659python-cryptography 3.2 is vulnerable to Bleichenbacher timi…5.9