Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

Gentoo: GLSA-202310-07 Normal: OpenSSH Security Vulnerability

gentoo
Calendar Grey November 6, 2014
Scroller Gentoo
Gentoo GLSA 202311-04 highlights a security flaw in OpenSSH which could lead to privilege escalation or unauthorized access.
A buffer overflow in TigerVNC could result in execution of arbitrary code or Denial of Service.

Summary

Two boundary errors in TigerVNC could lead to a heap-based buffer overflow.

Topics%20covered

Topics Covered

security advisory denial of service gentoo buffer overflow code execution vnc server

Resolution

All TigerVNC users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/tigervnc-1.3.1"

References

[ 1 ] CVE-2014-0011 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0011

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201411-03
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: TigerVNC: User-assisted execution of arbitrary code
Date: November 05, 2014
Bugs: #505170
ID: 201411-03

Topics%20covered

Topics Covered

security advisory denial of service gentoo buffer overflow code execution vnc server

Synopsis

A buffer overflow in TigerVNC could result in execution of arbitrary code or Denial of Service.

Background

TigerVNC is a high-performance VNC server/client.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/tigervnc < 1.3.1 >= 1.3.1

Impact

===== A remote attacker could entice a user to connect to a malicious VNC server using TigerVNC, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.