Univention Bugzilla – Bug 50920
libvncserver: Multiple issues (4.3)
Last modified: 2020-03-11 13:57:31 CET
New Debian libvncserver 0.9.11+dfsg-1.3~deb9u3 fixes: This update addresses the following issue: * LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)
--- mirror/ftp/4.3/unmaintained/4.3-4/source/libvncserver_0.9.11+dfsg-1.3~deb9u1.dsc +++ apt/ucs_4.3-0-errata4.3-5/source/libvncserver_0.9.11+dfsg-1.3~deb9u3.dsc @@ -1,3 +1,23 @@ +0.9.11+dfsg-1.3~deb9u3 [Wed, 08 Jan 2020 08:22:51 +0100] Mike Gabriel <sunweaver@debian.org>: + + * Regression update. + + * debian/patches: Add use-after-free/{4,5,6}.patch. All cherry-picked from + upstream. Resolves crashing of x11vnc when vncviewer connects. (Closes: + #905786). + +0.9.11+dfsg-1.3~deb9u2 [Mon, 16 Dec 2019 11:08:42 +0100] Mike Gabriel <sunweaver@debian.org>: + + * CVE-2019-15681: + + rfbserver: don't leak stack memory to the remote. (Closes: #943793). + * debian/patches: + + Trivial patch rebasing. + + Add 3 use-after-free patches. Resolve a freeze during connection + closure and a segmentation fault on multi-threaded VNC servers. (Closes: + #905786). + + Add 0002-set-true-color-flag-to-1.patch. Fix connecting to VMware servers. + (Closes: #880531). + 0.9.11+dfsg-1.3~deb9u1 [Sat, 02 Feb 2019 22:41:23 +0100] Salvatore Bonaccorso <carnil@debian.org>: * Non-maintainer upload by the Security Team. <http://10.200.17.11/4.3-5/#413696957008372455>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.3-5] 40f65b9a0f Bug #50920: libvncserver 0.9.11+dfsg-1.3~deb9u3 doc/errata/staging/libvncserver.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) [4.3-5] 1e4c108db1 Bug #50920: libvncserver 0.9.11+dfsg-1.3~deb9u3 doc/errata/staging/libvncserver.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
<http://errata.software-univention.de/ucs/4.3/644.html>