Scientific Linux: 2014-1826-1 Moderate: libvncserver Buffer Overflow

Date: Wed, 12 Nov 2014 15:19:57 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: libvncserver on SL6.x, SL7.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: libvncserver security update
Advisory ID: SLSA-2014:1826-1
Issue Date: 2014-11-11
CVE Numbers: CVE-2014-6051
 CVE-2014-6052
 CVE-2014-6053
 CVE-2014-6054
 CVE-2014-6055
--

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way screen sizes were handled by LibVNCServer. A malicious
VNC server could use this flaw to cause a client to crash or, potentially,
execute arbitrary code in the client. (CVE-2014-6051)

A NULL pointer dereference flaw was found in LibVNCServer's framebuffer
setup. A malicious VNC server could use this flaw to cause a VNC client to
crash. (CVE-2014-6052)

A NULL pointer dereference flaw was found in the way LibVNCServer handled
certain ClientCutText message. A remote attacker could use this flaw to
crash the VNC server by sending a specially crafted ClientCutText message
from a VNC client. (CVE-2014-6053)

A divide-by-zero flaw was found in the way LibVNCServer handled the
scaling factor when it was set to "0". A remote attacker could use this
flaw to crash the VNC server using a malicious VNC client. (CVE-2014-6054)

Two stack-based buffer overflow flaws were found in the way LibVNCServer
handled file transfers. A remote attacker could use this flaw to crash the
VNC server using a malicious VNC client. (CVE-2014-6055)

All running applications linked against libvncserver must be restarted for
this update to take effect.
--

SL6
 x86_64
 libvncserver-0.9.7-7.el6_6.1.x86_64.rpm
 libvncserver-debuginfo-0.9.7-7.el6_6.1.x86_64.rpm
 libvncserver-0.9.7-7.el6_6.1.i686.rpm
 libvncserver-debuginfo-0.9.7-7.el6_6.1.i686.rpm
 libvncserver-devel-0.9.7-7.el6_6.1.i686.rpm
 libvncserver-devel-0.9.7-7.el6_6.1.x86_64.rpm
 i386
 libvncserver-0.9.7-7.el6_6.1.i686.rpm
 libvncserver-debuginfo-0.9.7-7.el6_6.1.i686.rpm
 libvncserver-devel-0.9.7-7.el6_6.1.i686.rpm
SL7
 x86_64
 libvncserver-0.9.9-9.el7_0.1.i686.rpm
 libvncserver-0.9.9-9.el7_0.1.x86_64.rpm
 libvncserver-debuginfo-0.9.9-9.el7_0.1.i686.rpm
 libvncserver-debuginfo-0.9.9-9.el7_0.1.x86_64.rpm
 libvncserver-devel-0.9.9-9.el7_0.1.i686.rpm
 libvncserver-devel-0.9.9-9.el7_0.1.x86_64.rpm

- Scientific Linux Development Team