libvncserver-0.9.11-17.el8
エラータID: AXSA:2021-2098:01
リリース日:
2021/06/29 Tuesday - 06:03
題名:
libvncserver-0.9.11-17.el8
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- LibVNCServer の libvncclient/rfbproto.c ファイルの ConnectToRFBRepeater 関数には、
初期化されていないメモリ内容が情報漏洩する脆弱性があります。(CVE-2018-21247)
- LibVNCServer の libvncclient/sockets.c には、ロングファイルネームを持つソケットファ
イルによるバッファーオバーフローの脆弱性があります。(CVE-2019-20839)
- LibVNCServer の libvncserver/rfbregion.c には、 NULL ポインタデリファレンス の脆弱性
があります。(CVE-2020-14397)
- LibVNCServer の libvncclient/rfbproto.c には、 TextChat サイズを制限していない脆弱性が
あります。(CVE-2020-14405)
- libvncserver にはゼロ除算の問題があり、悪意のあるクライアントがこの問題を利用して巧
妙に細工されたメッセージを送信し VNC サーバーで処理されると、浮動小数点例外が発生し
サービス拒否状態になる脆弱性があります。(CVE-2020-25708)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-21247
An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.
An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.
CVE-2019-20839
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
CVE-2020-14397
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
CVE-2020-14405
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.
CVE-2020-25708
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.
追加情報:
N/A
ダウンロード:
SRPMS
- libvncserver-0.9.11-17.el8.src.rpm
MD5: a9391ce470764badcc961842caad503e
SHA-256: 4a9d8e220c1959eb815052d48b8b406fa2ef7bd2ab85e3df7612dc04320890f4
Size: 1.39 MB
Asianux Server 8 for x86_64
- libvncserver-0.9.11-17.el8.x86_64.rpm
MD5: c8e2af0856bd7ae5ef4baf64697ca33c
SHA-256: 6ebbb2ea1e53abea24ff8a31656f9baf8478c03010806a2fd3470187593e0cef
Size: 274.31 kB - libvncserver-0.9.11-17.el8.i686.rpm
MD5: d0f62bd6fa14256ddf4034fcd1624311
SHA-256: 0c87e3139474d9abcd1aba02ced3f9490a7ffcf32d145c24fed6edb7458cf4a9
Size: 284.36 kB
English