Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia: 2020-0435 Critical: LibVNCServer Security Problems Exploited

mageia
Calendar Grey November 23, 2020
Dist Mageia Esm H88
Recent updates to italc packages remedy several security vulnerabilities in Mageia that threaten LibVNCServer, posing significant risks.
An issue was discovered in LibVNCServer through 0.9.11

Summary

An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets. (CVE-2018-7225)
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution. (CVE-2018-15127)
LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution. (CVE-2018-20019)
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution. (CVE-2018-20020)
LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CW...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=27404

- https://ubuntu.com/security/notices/USN-4547-1

- https://ubuntu.com/security/notices/USN-4587-1

- https://www.cve.org/CVERecord?id=CVE-2018-7225

- https://www.cve.org/CVERecord?id=CVE-2018-15127

- https://www.cve.org/CVERecord?id=CVE-2018-20019

- https://www.cve.org/CVERecord?id=CVE-2018-20020

- https://www.cve.org/CVERecord?id=CVE-2018-20021

- https://www.cve.org/CVERecord?id=CVE-2018-20022

- https://www.cve.org/CVERecord?id=CVE-2018-20023

- https://www.cve.org/CVERecord?id=CVE-2018-20024

- https://www.cve.org/CVERecord?id=CVE-2018-20748

- https://www.cve.org/CVERecord?id=CVE-2018-20749

- https://www.cve.org/CVERecord?id=CVE-2018-20750

- https://www.cve.org/CVERecord?id=CVE-2019-15681

Topics%20covered

Topics Covered

security advisory buffer overflow remote code execution DoS integer overflow LibVNCServer Mageia

Resolution

SRPMS

- 7/core/italc-3.0.3-3.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 23 Nov 2020
URL: https://advisories.mageia.org/MGASA-2020-0435.html
Type: security
CVE: CVE-2018-7225, CVE-2018-15127, CVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20023, CVE-2018-20024, CVE-2018-20748, CVE-2018-20749, CVE-2018-20750, CVE-2019-15681

Topics%20covered

Topics Covered

security advisory buffer overflow remote code execution DoS integer overflow LibVNCServer Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here