tigervnc-1.12.0-13.el9

エラータID: AXSA:2023-5620:09

Release date: 
Monday, May 29, 2023 - 12:48
Subject: 
tigervnc-1.12.0-13.el9
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
Moderate
Description: 

Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

Security Fix(es):

* xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283)
* xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340)
* xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341)
* xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342)
* xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343)
* xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the MIRACLE LINUX 9.2 Release Notes linked from the References section.

CVE-2022-4283
A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVE-2022-46340
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
CVE-2022-46341
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVE-2022-46342
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se
CVE-2022-46343
A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVE-2022-46344
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. tigervnc-1.12.0-13.el9.src.rpm
    MD5: 2ec763a004d441eab803b774d49243d0
    SHA-256: 809900c95ea45c9f1e1977a5a2d76a7488e2da05e5162f788bb787ad30d19ce2
    Size: 1.53 MB

Asianux Server 9 for x86_64
  1. tigervnc-1.12.0-13.el9.x86_64.rpm
    MD5: 54f66ff5c250f5936e6a2a0deaa87166
    SHA-256: 7225a2af2edfab6dbea13a9076237a1e4b4673b72eb3a515b26599d570229349
    Size: 323.43 kB
  2. tigervnc-icons-1.12.0-13.el9.noarch.rpm
    MD5: 1cac34092a8f5f39911c17be41ddf44f
    SHA-256: f07044e93751ee6d2e7eb59cdc34d5cff0db2ca71fdb361bb412b914769132f1
    Size: 23.30 kB
  3. tigervnc-license-1.12.0-13.el9.noarch.rpm
    MD5: 72cd2de791d9416870dc12f5d4ef65cf
    SHA-256: f6844fe8d71453a20bc5423ecdbe3cb9baa6e56bc6f446e89d52257dbfa0cf6c
    Size: 16.01 kB
  4. tigervnc-selinux-1.12.0-13.el9.noarch.rpm
    MD5: 403420184adf95230d2861ec2f47e379
    SHA-256: 30734acff23c196e05b89231a29edf19e905d4af56cad2dd80c2c9076b3daf83
    Size: 24.57 kB
  5. tigervnc-server-1.12.0-13.el9.x86_64.rpm
    MD5: 610f0d11d473e26582ad2cefef16ae41
    SHA-256: eec57d018073b68388da9ddea9786ccee7aa79148a7124e0220134ae77ac5372
    Size: 258.73 kB
  6. tigervnc-server-minimal-1.12.0-13.el9.x86_64.rpm
    MD5: 6a70d28497e4cacfe6ff5b3d129bbc00
    SHA-256: 51ee3931474ed476b7125abda0cae6f7d92b8a2f640856c6dfe433b48a1fc5f2
    Size: 1.13 MB
  7. tigervnc-server-module-1.12.0-13.el9.x86_64.rpm
    MD5: e107a10a27e4ab1693dc670e3e3097f0
    SHA-256: 7d6975b4c520242c02d49b7e2432a4050cd31ab49bd3045f10d690959ce7ab47
    Size: 234.89 kB