Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
203
security advisoryremote code executionnetwork exploitMageia 6: MGASA-2019-0037 Moderate: libvncserver Remote Code Execution
A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-6307). . MGASA-2019-0037 - Updated libvncserver & x11vnc packages fix security vulnerabilities Publication date: 15 Jan 2019 URL: https://advisories.mageia.org/MGASA-2019-0037.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-6307, CVE-2018-15126, CVE-2018-15127, CVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20023, CVE-2018-20024 A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-6307). A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-15126). A heap out-of-bound write vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-15127). Multiple heap out-of-bound write vulnerabilities in VNC client code, which can result in remote code execution (CVE-2018-20019). Heap out-of-bound write vulnerability in a structure in VNC client code, which can result in remote code execution (CVE-2018-20020). Infinite Loop vulnerability in VNC client code. The vulnerability could allow an attacker to consume an excessive amount of resources, such as CPU and RAM (CVE-2018-20021). Improper Initialization weaknesses in VNC client code, which could allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR (CVE-2018-20022). Improper Initialization vulnerability in VNC Repeater client code, which could allowan attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR (CVE-2018-20023). A null pointer dereference in VNC client code, which can result in DoS (CVE-2018-20024). References: - https://bugs.mageia.org/show_bug.cgi?id=24177 - https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.12 - https://github.com/LibVNC/x11vnc/releases/tag/0.9.15 - https://github.com/LibVNC/x11vnc/releases/tag/0.9.16 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - - https://www.cve.org/CVERecord?id=CVE-2018-6307 - https://www.cve.org/CVERecord?id=CVE-2018-15126 - https://www.cve.org/CVERecord?id=CVE-2018-15127 - https://www.cve.org/CVERecord?id=CVE-2018-20019 - https://www.cve.org/CVERecord?id=CVE-2018-20020 - https://www.cve.org/CVERecord?id=CVE-2018-20021 - https://www.cve.org/CVERecord?id=CVE-2018-20022 - https://www.cve.org/CVERecord?id=CVE-2018-20023 - https://www.cve.org/CVERecord?id=CVE-2018-20024 SRPMS: - 6/core/libvncserver-0.9.12-1.mga6 - 6/core/x11vnc-0.9.16-1.mga6 . MGASA-2019-0037 - Updated libvncserver & x11vnc packages fix security vulnerabilities Publication da. use-after-free, vulnerability, server, transfer, extension, which. . LinuxSecurity.com Team
Jan 15, 2019
Mageia
91
security advisorygentooarbitrary codeGentoo: 200903-17 Normal: Real VNC Client Arbitrary Code Risk
The Real VNC client is vulnerable to execution of arbitrary code when connecting to a malicious server.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200903-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Real VNC: User-assisted execution of arbitrary code Date: March 09, 2009 Bugs: #255225 ID: 200903-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The Real VNC client is vulnerable to execution of arbitrary code when connecting to a malicious server. Background ========= Real VNC is a remote desktop viewer display system. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/vnc < 4.1.3 > = 4.1.3 Description ========== An unspecified vulnerability has been discovered int the CMsgReader::readRect() function in the VNC Viewer component, related to the encoding type of RFB protocol data. Impact ===== A remote attacker could entice a user to connect to a malicious VNC server, or leverage Man-in-the-Middle attacks, to cause the execution of arbitrary code with the privileges of the user running the VNC viewer. Workaround ========= There is no known workaround at this time. Resolution ========= All Real VNC users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-misc/vnc-4.1.3" References ========= [ 1 ] CVE-2008-4770 https://www.cve.org/CVERecord?id=CVE-2008-4770 Availability =========== This GLSA and any updates to it are available for viewingat the Gentoo Security Website: https://security.gentoo.org/glsa/200903-17 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Mar 09, 2009
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!