SUSE-SU-2019:0060-1
Security update for LibVNCServer
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 12 | libvncclient0, libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.1 | libvncclient0, libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.2 | libvncclient0, libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.3 | LibVNCServer-devel, libvncclient0, libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.4 | LibVNCServer-devel, libvncclient0, libvncserver0 | 0.9.9-17.8.1 |
Show all 12 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 12 | libvncclient0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12 | libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.1 | libvncclient0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.1 | libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.2 | libvncclient0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.2 | libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.3 | LibVNCServer-devel | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.3 | libvncclient0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.3 | libvncserver0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.4 | LibVNCServer-devel | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.4 | libvncclient0 | 0.9.9-17.8.1 |
| SUSE Linux Enterprise 12.4 | libvncserver0 | 0.9.9-17.8.1 |
References
- https://bugzilla.suse.com/1120114
- https://bugzilla.suse.com/1120115
- https://bugzilla.suse.com/1120116
- https://bugzilla.suse.com/1120117
- https://bugzilla.suse.com/1120118
- https://bugzilla.suse.com/1120119
- https://bugzilla.suse.com/1120120
- https://bugzilla.suse.com/1120121
All 21 references
- https://bugzilla.suse.com/1120122
- https://lists.suse.com/pipermail/sle-security-updates/2019-January/005025.html
- https://www.suse.com/security/cve/CVE-2018-15126/
- https://www.suse.com/security/cve/CVE-2018-15127/
- https://www.suse.com/security/cve/CVE-2018-20019/
- https://www.suse.com/security/cve/CVE-2018-20020/
- https://www.suse.com/security/cve/CVE-2018-20021/
- https://www.suse.com/security/cve/CVE-2018-20022/
- https://www.suse.com/security/cve/CVE-2018-20023/
- https://www.suse.com/security/cve/CVE-2018-20024/
- https://www.suse.com/security/cve/CVE-2018-6307/
- https://www.suse.com/support/security/rating/
- https://www.suse.com/support/update/announcement/2019/suse-su-20190060-1/