Univention Bugzilla – Bug 51925
libvncserver: Multiple issues (4.4)
Last modified: 2020-09-02 11:40:03 CEST
New Debian libvncserver 0.9.11+dfsg-1.3~deb9u5 fixes: This update addresses the following issues: * "ConnectClientToUnixSock()" buffer overflow (CVE-2019-20839) * libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397) * byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c (CVE-2020-14399) * byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c (CVE-2020-14400) * libvncserver/scale.c has a pixel_value integer overflow (CVE-2020-14401) * libvncserver/corre.c allows out-of-bounds access via encodings (CVE-2020-14402) * libvncserver/hextile.c allows out-of-bounds access via encodings (CVE-2020-14403) * libvncserver/rre.c allows out-of-bounds access via encodings (CVE-2020-14404) * libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)
--- mirror/ftp/4.4/unmaintained/component/4.4-5-errata/source/libvncserver_0.9.11+dfsg-1.3~deb9u4.dsc +++ apt/ucs_4.4-0-errata4.4-5/source/libvncserver_0.9.11+dfsg-1.3~deb9u5.dsc @@ -1,3 +1,14 @@ +0.9.11+dfsg-1.3~deb9u5 [Fri, 28 Aug 2020 21:22:58 +0200] Mike Gabriel <sunweaver@debian.org>: + + * CVE-2019-20839: libvncclient: bail out if unix socket name would overflow. + * CVE-2020-14397: libvncserver: add missing NULL pointer checks. + * CVE-2020-14399: libvncclient: fix pointer aliasing/alignment issue. + * CVE-2020-14400: libvncserver: fix pointer aliasing/alignment issue. + * CVE-2020-14401: libvncserver: scale: cast to 64 bit before shifting. + * CVE-2020-14402, CVE-2020-14403, CVE-2020-14404: libvncserver: encodings: + prevent OOB accesses. + * CVE-2020-14405: libvncclient/rfbproto: limit max textchat size. + 0.9.11+dfsg-1.3~deb9u4 [Tue, 31 Mar 2020 07:56:01 +0200] Mike Gabriel <sunweaver@debian.org>: [ Antoni Villalonga ] <http://10.200.17.11/4.4-5/#413696957006207405>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-5] 1410e809f9 Bug #51925: libvncserver 0.9.11+dfsg-1.3~deb9u5 doc/errata/staging/libvncserver.yaml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x730>