Mageia 6: MGASA-2019-0037 Moderate: libvncserver Remote Code Execution
mageia
January 15, 2019
A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution
Summary
A heap use-after-free vulnerability in the server code of the file
transfer extension, which can result in remote code execution. This
attack appears to be exploitable via network connectivity
(CVE-2018-6307).
A heap use-after-free vulnerability in the server code of the file
transfer extension, which can result in remote code execution. This
attack appears to be exploitable via network connectivity
(CVE-2018-15126).
A heap out-of-bound write vulnerability in the server code of the file
transfer extension, which can result in remote code execution. This
attack appears to be exploitable via network connectivity
(CVE-2018-15127).
Multiple heap out-of-bound write vulnerabilities in VNC client code,
which can result in remote code execution (CVE-2018-20019).
Heap out-of-bound write vulnerability in a structure in VNC client code,
which can result in remote code execution (CVE-2018-20020).
Infinite Loop vulnerability in VNC client code. The vulnerability could
allow an attacker to consum...
References
- https://bugs.mageia.org/show_bug.cgi?id=24177
- https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.12
- https://github.com/LibVNC/x11vnc/releases/tag/0.9.15
- https://github.com/LibVNC/x11vnc/releases/tag/0.9.16
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html
- - https://www.cve.org/CVERecord?id=CVE-2018-6307
- https://www.cve.org/CVERecord?id=CVE-2018-15126
- https://www.cve.org/CVERecord?id=CVE-2018-15127
- https://www.cve.org/CVERecord?id=CVE-2018-20019
- https://www.cve.org/CVERecord?id=CVE-2018-20020
- https://www.cve.org/CVERecord?id=CVE-2018-20021
- https://www.cve.org/CVERecord?id=CVE-2018-20022
- https://www.cve.org/CVERecord?id=CVE-2018-20023
- https://www.cve.org/CVERecord?id=CVE-2018-20024
Resolution
SRPMS
- 6/core/libvncserver-0.9.12-1.mga6
- 6/core/x11vnc-0.9.16-1.mga6
PREVIOUS
NEXT
Publication date: 15 Jan 2019
URL: https://advisories.mageia.org/MGASA-2019-0037.html
Type: security
CVE: CVE-2018-6307,
CVE-2018-15126,
CVE-2018-15127,
CVE-2018-20019,
CVE-2018-20020,
CVE-2018-20021,
CVE-2018-20022,
CVE-2018-20023,
CVE-2018-20024
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!