[{"CVE":"CVE-2020-14355","severity":"important","public_date":"2020-10-06T12:00:00Z","advisories":["RHSA-2020:4187","RHSA-2020:4186","RHSA-2020:4185","RHSA-2020:4184"],"bugzilla":"1868435","bugzilla_description":"CVE-2020-14355 spice: multiple buffer overflow vulnerabilities in QUIC decoding code","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-119","affected_packages":["spice-gtk-0:0.35-5.el7_9.1","spice-gtk-0:0.37-1.el8_2.2","spice-0:0.14.0-9.el7_9.1","spice-0:0.14.2-1.el8_2.1"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-14355.json","cvss3_scoring_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","cvss3_score":"5.5"},{"CVE":"CVE-2018-10893","severity":"moderate","public_date":"2018-06-25T00:00:00Z","advisories":["RHSA-2020:0471","RHSA-2019:2229"],"bugzilla":"1598234","bugzilla_description":"CVE-2018-10893 spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows","cvss_score":null,"cvss_scoring_vector":null,"CWE":"(CWE-122|CWE-190)","affected_packages":["spice-gtk-0:0.26-8.el6_10.2","spice-gtk-0:0.35-4.el7"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-10893.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L","cvss3_score":"7.6"},{"CVE":"CVE-2017-12194","severity":"moderate","public_date":"2018-03-14T00:00:00Z","advisories":[],"bugzilla":"1501200","bugzilla_description":"CVE-2017-12194 spice-gtk:  Integer overflows causing buffer overflows in spice-client","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-121","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12194.json","cvss3_scoring_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","cvss3_score":"5.5"},{"CVE":"CVE-2016-3066","severity":"low","public_date":"2016-03-22T00:00:00Z","advisories":[],"bugzilla":"1320263","bugzilla_description":"CVE-2016-3066 spice-gtk: hijacks clipboard and sends contents to remote servers","cvss_score":3.5,"cvss_scoring_vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","CWE":"CWE-200","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-3066.json"},{"CVE":"CVE-2013-4324","severity":"important","public_date":"2013-09-18T00:00:00Z","advisories":["RHSA-2013:1273"],"bugzilla":"1006669","bugzilla_description":"CVE-2013-4324 spice-gtk: Insecure calling of polkit via polkit_unix_process_new()","cvss_score":6.9,"cvss_scoring_vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","CWE":null,"affected_packages":["spice-gtk-0:0.14-7.el6_4.3"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4324.json"},{"CVE":"CVE-2012-4425","severity":"moderate","public_date":"2012-09-12T00:00:00Z","advisories":["RHSA-2012:1284"],"bugzilla":"857283","bugzilla_description":"CVE-2012-4425 spice-gtk/glib: Possible privilege escalation via un-sanitized environment variable","cvss_score":6.9,"cvss_scoring_vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","CWE":null,"affected_packages":["spice-gtk-0:0.11-11.el6_3.1"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-4425.json"}]