Univention Bugzilla – Bug 48597
libvncserver: Multiple issues (4.2)
Last modified: 2019-02-06 12:56:01 CET
New Debian libvncserver 0.9.9+dfsg2-6.1+deb8u5 fixes: This update addresses the following issues: * Use-after-free in file transfer extension allows for potential code execution (CVE-2018-15126) * Multiple heap out-of-bound writes in VNC client code (Incomplete fix for CVE-2018-20019) (CVE-2018-20748) * Heap out-of-bounds write in rfbserver.c in rfbProcessFileTransferReadBuffer() allows for potential code execution (Incomplete fix for CVE-2018-15127) (CVE-2018-20749) * Heap out-of-bounds write in rfbserver.c in rfbProcessFileTransferReadBuffer() allows for potential code execution (Incomplete fix for CVE-2018-15127) (CVE-2018-20750)
--- mirror/ftp/4.2/unmaintained/component/4.2-5-errata/source/libvncserver_0.9.9+dfsg2-6.1+deb8u4.dsc +++ apt/ucs_4.2-0-errata4.2-5/source/libvncserver_0.9.9+dfsg2-6.1+deb8u5.dsc @@ -1,3 +1,16 @@ +0.9.9+dfsg2-6.1+deb8u5 [Thu, 31 Jan 2019 12:17:10 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: + + * Non-maintainer upload by the Debian LTS Team. + * CVE-2018-20748: incomplete fix for CVE-2018-20019 oob heap writes. + * CVE-2018-20749: incomplete fix for CVE-2018-15127 oob heap writes. + * CVE-2018-20750: incomplete fix for CVE-2018-15127 oob heap writes. + * CVE-2018-15126: heap use-after-free resulting in possible RCE. + * debian/libvncserver0.symbols: update for the symbol changes in the + CVE-2018-15126 patch, which split a function in two with new names. + This is not really an ABI change as these symbols are private, i.e. not + exported in any public headers, and only exported on the DSO because + there's no filter applied. + 0.9.9+dfsg2-6.1+deb8u4 [Sun, 23 Dec 2018 16:21:23 +0530] Abhijith PA <abhijith@debian.org>: * Non-maintainer upload by the Debian LTS Team. <http://10.200.17.11/4.2-5/#6773918246538283631>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.2-5] 44280bb3cd Bug #48597: libvncserver 0.9.9+dfsg2-6.1+deb8u5 doc/errata/staging/libvncserver.yaml | 1 - 1 file changed, 1 deletion(-) [4.2-5] 834fdc2f42 Bug #48597: libvncserver 0.9.9+dfsg2-6.1+deb8u5 doc/errata/staging/libvncserver.yaml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
<http://errata.software-univention.de/ucs/4.2/594.html>