Date:         Wed, 12 Nov 2014 15:20:03 +0000
Reply-To:     scientific-linux-users@listserv.fnal.gov
Sender:       Security Errata for Scientific Linux
              
From:         Pat Riehecky 
Subject:      Security ERRATA Moderate: kdenetwork on SL7.x x86_64
MIME-Version: 1.0

Synopsis:          Moderate: kdenetwork security update
Advisory ID:       SLSA-2014:1827-1
Issue Date:        2014-11-11
CVE Numbers:       CVE-2014-6053
                   CVE-2014-6054
                   CVE-2014-6055
--

A NULL pointer dereference flaw was found in the way LibVNCServer handled
certain ClientCutText message. A remote attacker could use this flaw to
crash the VNC server by sending a specially crafted ClientCutText message
from a VNC client. (CVE-2014-6053)

A divide-by-zero flaw was found in the way LibVNCServer handled the
scaling factor when it was set to "0". A remote attacker could use this
flaw to crash the VNC server using a malicious VNC client. (CVE-2014-6054)

Two stack-based buffer overflow flaws were found in the way LibVNCServer
handled file transfers. A remote attacker could use this flaw to crash the
VNC server using a malicious VNC client. (CVE-2014-6055)

Note: Prior to this update, the kdenetwork packages used an embedded copy
of the LibVNCServer library. With this update, the kdenetwork packages
have been modified to use the system LibVNCServer packages. Therefore, the
update provided by SLSA-2014:1826 must be installed to fully address the
issues in krfb described above.

All running instances of the krfb server must be restarted for this update
to take effect.
--

SL7
  x86_64
    kdenetwork-debuginfo-4.10.5-8.el7_0.i686.rpm
    kdenetwork-debuginfo-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kdnssd-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kget-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kget-libs-4.10.5-8.el7_0.i686.rpm
    kdenetwork-kget-libs-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-krdc-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-krdc-libs-4.10.5-8.el7_0.i686.rpm
    kdenetwork-krdc-libs-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-krfb-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-krfb-libs-4.10.5-8.el7_0.i686.rpm
    kdenetwork-krfb-libs-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-fileshare-samba-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kopete-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kopete-devel-4.10.5-8.el7_0.i686.rpm
    kdenetwork-kopete-devel-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-kopete-libs-4.10.5-8.el7_0.i686.rpm
    kdenetwork-kopete-libs-4.10.5-8.el7_0.x86_64.rpm
    kdenetwork-krdc-devel-4.10.5-8.el7_0.i686.rpm
    kdenetwork-krdc-devel-4.10.5-8.el7_0.x86_64.rpm
  noarch
    kdenetwork-common-4.10.5-8.el7_0.noarch.rpm
    kdenetwork-devel-4.10.5-8.el7_0.noarch.rpm

- Scientific Linux Development Team