MGASA-2021-0040 - Updated synergy packages fix a security vulnerability

Publication date: 17 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0040.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-15117

In Synergy before version 1.12.0, a Synergy server can be crashed by receiving
a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295)
if the servers memory is less than 4 GB. It was verified that this issue does
not cause a crash through the exception handler if the available memory of the
Server is more than 4GB (CVE-2020-15117).

The synergy package has been updated to version 1.12.0, fixing this issue and
several other bugs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=27851
- https://github.com/symless/synergy-core/security/advisories/GHSA-chfm-333q-gfpp
- https://github.com/symless/synergy-core/releases/tag/1.11.0-stable
- https://github.com/symless/synergy-core/releases/tag/v1.11.1-stable
- https://github.com/symless/synergy-core/releases/tag/v1.12.0-stable
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/VFDEQED64YLWQK2TF73EMXZDYX7YT2DD/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15117

SRPMS:
- 7/core/synergy-1.12.0-1.mga7