Ubuntu 20.04 LTS: 4407-1 Moderate: LibVNCServer Denial Of Service

ubuntu

July 2, 2020

Several security issues were fixed in LibVNCServer.

Summary

Several security issues were fixed in LibVNCServer.

Software Description:

- libvncserver: vnc server library

Details:

It was discovered that LibVNCServer incorrectly handled decompressing

data. An

attacker could possibly use this issue to cause LibVNCServer to crash,

resulting in a denial of service. (CVE-2019-15680)

It was discovered that an information disclosure vulnerability existed in

LibVNCServer when sending a ServerCutText message. An attacker could

possibly

use this issue to expose sensitive information. This issue only affected

Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)

It was discovered that LibVNCServer incorrectly handled cursor shape

updates.

If a user were tricked in to connecting to a malicious server, an attacker

could possibly use this issue to cause LibVNCServer to crash, resulting in a

denial of service, or possibly execute arbitrary code. This issue only

affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue software update information disclosure ubuntu libvncserver

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
libvncclient1 0.9.12+dfsg-9ubuntu0.1
libvncserver1 0.9.12+dfsg-9ubuntu0.1

Ubuntu 19.10:
libvncclient1 0.9.11+dfsg-1.3ubuntu0.1
libvncserver1 0.9.11+dfsg-1.3ubuntu0.1

Ubuntu 18.04 LTS:
libvncclient1 0.9.11+dfsg-1ubuntu1.2
libvncserver1 0.9.11+dfsg-1ubuntu1.2

Ubuntu 16.04 LTS:
libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.4
libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.4

After a standard system update you need to restart LibVNCServer to make
all the necessary changes.