This update for LibVNCServer fixes the following issues :

security update

added patches fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak

  + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839     [bsc#1173875], buffer overflow in     ConnectClientToUnixSock()

  + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840     [bsc#1173876], unaligned accesses in hybiReadAndDecode     can lead to denial of service

  + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398     [bsc#1173880], improperly closed TCP connection causes     an infinite loop in libvncclient/sockets.c

  + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397     [bsc#1173700], NULL pointer dereference in     libvncserver/rfbregion.c

  + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399     [bsc#1173743], Byte-aligned data is accessed through     uint32_t pointers in libvncclient/rfbproto.c.

  + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400     [bsc#1173691], Byte-aligned data is accessed through     uint16_t pointers in libvncserver/translate.c.

  + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401     [bsc#1173694], potential integer overflows in     libvncserver/scale.c

  + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402     [bsc#1173701], out-of-bounds access via encodings.

  + LibVNCServer-CVE-2020-14402,14403,14404.patch fix     CVE-2017-18922 [bsc#1173477], preauth buffer overwrite

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1922-1)

critical Nessus Plugin ID 138548

Version 1.3

Version 1.2

Version 1.3 Mar 1, 2024, 4:03 PM CVSSv2 score source (set to "CVE-2017-18922") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202403011603
Version 1.2 Mar 1, 2024, 1:53 PM CVSSv2 score source (set to "CVE-2017-18922") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202403011353