Bug 50868 - libvncserver: Multiple issues (4.4)
libvncserver: Multiple issues (4.4)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.4
All Linux
: P5 normal (vote)
: UCS 4.4-3-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-02-27 15:33 CET by Quality Assurance
Modified: 2020-03-11 14:41 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted after Product Owner Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 0.0 () NVD


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2020-02-27 15:33:47 CET
New Debian libvncserver 0.9.11+dfsg-1.3~deb9u3 fixes:
This update addresses the following issue:
* LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a  memory leak (CWE-655) in VNC server code, which allow an attacker to read  stack memory and can be abused for information disclosure. Combined with  another vulnerability, it can be used to leak stack memory and bypass ASLR.  This attack appear to be exploitable via network connectivity. These  vulnerabilities have been fixed in commit  d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)
Comment 1 Quality Assurance univentionstaff 2020-02-27 16:01:06 CET
--- mirror/ftp/4.4/unmaintained/4.4-0/source/libvncserver_0.9.11+dfsg-1.3~deb9u1.dsc
+++ apt/ucs_4.4-0-errata4.4-3/source/libvncserver_0.9.11+dfsg-1.3~deb9u3.dsc
@@ -1,3 +1,23 @@
+0.9.11+dfsg-1.3~deb9u3 [Wed, 08 Jan 2020 08:22:51 +0100] Mike Gabriel <sunweaver@debian.org>:
+
+  * Regression update.
+
+  * debian/patches: Add use-after-free/{4,5,6}.patch. All cherry-picked from
+    upstream. Resolves crashing of x11vnc when vncviewer connects. (Closes:
+    #905786).
+
+0.9.11+dfsg-1.3~deb9u2 [Mon, 16 Dec 2019 11:08:42 +0100] Mike Gabriel <sunweaver@debian.org>:
+
+  * CVE-2019-15681:
+    + rfbserver: don't leak stack memory to the remote. (Closes: #943793).
+  * debian/patches:
+    + Trivial patch rebasing.
+    + Add 3 use-after-free patches. Resolve a freeze during connection
+      closure and a segmentation fault on multi-threaded VNC servers. (Closes:
+      #905786).
+    + Add 0002-set-true-color-flag-to-1.patch. Fix connecting to VMware servers.
+      (Closes: #880531).
+
 0.9.11+dfsg-1.3~deb9u1 [Sat, 02 Feb 2019 22:41:23 +0100] Salvatore Bonaccorso <carnil@debian.org>:
 
   * Non-maintainer upload by the Security Team.

<http://10.200.17.11/4.4-3/#413696957008372455>
Comment 2 Philipp Hahn univentionstaff 2020-03-09 13:15:28 CET
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.4-3] ead75e0aa0 Bug #50868: libvncserver 0.9.11+dfsg-1.3~deb9u3
 doc/errata/staging/libvncserver.yaml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

[4.4-3] dcc5785377 Bug #50868: libvncserver 0.9.11+dfsg-1.3~deb9u3
 doc/errata/staging/libvncserver.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
Comment 3 Erik Damrose univentionstaff 2020-03-11 14:41:58 CET
<http://errata.software-univention.de/ucs/4.4/462.html>