ALT-PU-2019-2548-1
Package libvncserver updated to version 0.9.11-alt4 for branch p9 in task 236672.
Closed vulnerabilities
Published: 2018-02-18
BDU:2018-01493
Уязвимость функции rfbProcessClientNormalMessage() кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании и получить несанкционированный доступ к конфиденциальным данным
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2018-02-19
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2018-7225
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
Severity: CRITICAL (9.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- http://www.openwall.com/lists/oss-security/2018/02/18/1
- http://www.openwall.com/lists/oss-security/2018/02/18/1
- 103107
- 103107
- RHSA-2018:1055
- RHSA-2018:1055
- https://github.com/LibVNC/libvncserver/issues/218
- https://github.com/LibVNC/libvncserver/issues/218
- [debian-lts-announce] 20180330 [SECURITY] [DLA 1332-1] libvncserver security update
- [debian-lts-announce] 20180330 [SECURITY] [DLA 1332-1] libvncserver security update
- [debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update
- [debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update
- [debian-lts-announce] 20191129 [SECURITY] [DLA 2014-1] vino security update
- [debian-lts-announce] 20191129 [SECURITY] [DLA 2014-1] vino security update
- [debian-lts-announce] 20191221 [SECURITY] [DLA 2045-1] tightvnc security update
- [debian-lts-announce] 20191221 [SECURITY] [DLA 2045-1] tightvnc security update
- GLSA-201908-05
- GLSA-201908-05
- USN-3618-1
- USN-3618-1
- USN-4547-1
- USN-4547-1
- USN-4573-1
- USN-4573-1
- USN-4587-1
- USN-4587-1
- DSA-4221
- DSA-4221