Several vulnerabilities have been discovered in libVNC (libvncserver Debian package), an implemenantation of the VNC server and client protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c had a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c does not limit TextChat size.

For Debian 8 'Jessie', these problems have been fixed in version 0.9.9+dfsg2-6.1+deb8u8.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

  - security update

  - added patches fix CVE-2018-21247 [bsc#1173874],     uninitialized memory contents are vulnerable to     Information leak

  + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839     [bsc#1173875], buffer overflow in     ConnectClientToUnixSock()

  + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840     [bsc#1173876], unaligned accesses in hybiReadAndDecode     can lead to denial of service

  + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398     [bsc#1173880], improperly closed TCP connection causes     an infinite loop in libvncclient/sockets.c

  + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397     [bsc#1173700], NULL pointer dereference in     libvncserver/rfbregion.c

  + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399     [bsc#1173743], Byte-aligned data is accessed through     uint32_t pointers in libvncclient/rfbproto.c.

  + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400     [bsc#1173691], Byte-aligned data is accessed through     uint16_t pointers in libvncserver/translate.c.

  + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401     [bsc#1173694], potential integer overflows in     libvncserver/scale.c

  + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402     [bsc#1173701], out-of-bounds access via encodings.

  + LibVNCServer-CVE-2020-14402,14403,14404.patch fix     CVE-2017-18922 [bsc#1173477], preauth buffer overwrite

This update was imported from the SUSE:SLE-15:Update update project.

New upstream bugfix and security release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream bugfix/security release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1811 advisory.

    - Fix CVE-2020-25708       Resolves: #1898078
    - Fix CVE-2019-20839       Resolves: #1851032
    - Fix CVE-2018-21247       Resolves: #1852516
    - Fix CVE-2020-14405       Resolves: #1860527

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
137907	Debian DLA-2264-1 : libvncserver security update	Nessus	Debian Local Security Checks	2020/7/1	2024/3/5	medium
138828	openSUSE Security Update : LibVNCServer (openSUSE-2020-1025)	Nessus	SuSE Local Security Checks	2020/7/22	2024/2/29	critical
138476	Fedora 31 : libvncserver (2020-37112ac660)	Nessus	Fedora Local Security Checks	2020/7/15	2024/3/1	critical
138530	Fedora 32 : libvncserver (2020-1a4b1c8271)	Nessus	Fedora Local Security Checks	2020/7/16	2024/3/1	critical
149968	Oracle Linux 8 : libvncserver (ELSA-2021-1811)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/10/22	high
149728	CentOS 8 : libvncserver (CESA-2021:1811)	Nessus	CentOS Local Security Checks	2021/5/19	2024/1/1	high

検出

プラグインの検索

medium

critical

critical

critical

high

high