远程 CentOS Linux 8 主机上安装的程序包受到 CESA-2020: 1497 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

远程 CentOS Linux 7 主机上安装的程序包受到 CESA-2020: 3875 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

安全修复：

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

远程 Oracle Linux 7 主机上安装的程序包受到 ELSA-2020-3875 公告中提及的多个漏洞的影响。

  - TigerVNC 1.10.1 之前的版本容易受到堆栈返回后使用的攻击，这是 ZRLEDecoder 中未能正确使用堆栈内存所致。如果解码例程抛出异常，则 ZRLEDecoder 可能尝试访问在堆栈展开过程中已释放的堆栈变量。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15691)

  - TigerVNC 1.10.1 之前的版本容易受到堆缓冲区溢出的攻击。可从 CopyRectDecoder 触发漏洞，这是值检查不正确所致。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。
    (CVE-2019-15692)

  - TigerVNC 1.10.1 之前的版本容易受到发生于 TightDecoder: : FilterGradient 中堆缓冲区溢出的攻击。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15693)

  - TigerVNC 1.10.1 之前的版本容易受到从 DecodeManager: : decodeRect 触发的堆缓冲区溢出的攻击。漏洞的产生是在处理 MemOutStream 过程中出现符号错误所致。
    利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15694)

  - TigerVNC 1.10.1 之前的版本易受到从 CMsgReader: : readSetCursor 触发的堆栈缓冲区溢出的攻击。漏洞的产生是对 PixelFormat 清理不充分所致。
    由于远程攻击者可以选择缓冲区起始位置的偏移以开始写入其值，因此利用此漏洞可能会导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 3875 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 tigervnc 版本低于 1.8.0-21.34。因此，如公告 ALAS-2021-1470 所述，该主机受到多个漏洞的影响。

  - TigerVNC 1.10.1 之前的版本容易受到堆栈返回后使用的攻击，这是 ZRLEDecoder 中未能正确使用堆栈内存所致。如果解码例程抛出异常，则 ZRLEDecoder 可能尝试访问在堆栈展开过程中已释放的堆栈变量。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15691)

  - TigerVNC 1.10.1 之前的版本容易受到堆缓冲区溢出的攻击。可从 CopyRectDecoder 触发漏洞，这是值检查不正确所致。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。
    (CVE-2019-15692)

  - TigerVNC 1.10.1 之前的版本容易受到发生于 TightDecoder: : FilterGradient 中堆缓冲区溢出的攻击。利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15693)

  - TigerVNC 1.10.1 之前的版本容易受到从 DecodeManager: : decodeRect 触发的堆缓冲区溢出的攻击。漏洞的产生是在处理 MemOutStream 过程中出现符号错误所致。
    利用此漏洞可能导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15694)

  - TigerVNC 1.10.1 之前的版本易受到从 CMsgReader: : readSetCursor 触发的堆栈缓冲区溢出的攻击。漏洞的产生是对 PixelFormat 清理不充分所致。
    由于远程攻击者可以选择缓冲区起始位置的偏移以开始写入其值，因此利用此漏洞可能会导致远程代码执行。此攻击似乎可通过网络连接加以利用。(CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

The version of tigervnc installed on the remote host is prior to 1.8.0-21.34. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1470 advisory.

  - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect     usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to     access stack variable, which has been already freed during the process of stack unwinding. Exploitation of     this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered     from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear to be exploitable via network connectivity.
    (CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via network connectivity. (CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially result into remote code execution. This attack appear     to be exploitable via network connectivity. (CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat.
    Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation     of this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc fixes the following issues :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc provides the following fixes :

Security issues fixed :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Non-security issue fixed :

Make sure CN in generated certificate doesn't exceed 64 characters.
(bnc#1041847)

Change with-vnc-key.sh to generate TLS certificate using current hostname to keep it short. (bsc#1041847)

Disable MIT-SHM extension when running under user 'vnc'. (bsc#1053373)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - tigervnc: Stack use-after-return due to incorrect usage     of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from     CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in     TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in     DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in     CMsgReader::readSetCursor (CVE-2019-15695)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3875 advisory.

  - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect     usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to     access stack variable, which has been already freed during the process of stack unwinding. Exploitation of     this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered     from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear to be exploitable via network connectivity.
    (CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via network connectivity. (CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially result into remote code execution. This attack appear     to be exploitable via network connectivity. (CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat.
    Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation     of this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3875 advisory.

  - tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in CMsgReader::readSetCursor (CVE-2019-15695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
146003	CentOS 8：tigervnc (CESA-2020: 1497)	Nessus	CentOS Local Security Checks	2/1/2021	1/24/2024	high
141600	CentOS 7：tigervnc (CESA-2020: 3875)	Nessus	CentOS Local Security Checks	10/20/2020	10/9/2024	high
141653	Scientific Linux 安全更新：SL7.x x86_64 上的 tigervnc (20201001)	Nessus	Scientific Linux Local Security Checks	10/21/2020	2/14/2024	high
141215	Oracle Linux 7：tigervnc (ELSA-2020-3875)	Nessus	Oracle Linux Local Security Checks	10/7/2020	2/16/2024	high
141028	RHEL 7：tigervnc (RHSA-2020: 3875)	Nessus	Red Hat Local Security Checks	9/29/2020	2/16/2024	high
144989	Amazon Linux AMI：tigervnc (ALAS-2021-1470)	Nessus	Amazon Linux Local Security Checks	1/14/2021	1/30/2024	high
144989	Amazon Linux AMI : tigervnc (ALAS-2021-1470)	Nessus	Amazon Linux Local Security Checks	1/14/2021	1/30/2024	high
145143	EulerOS 2.0 SP3 : tigervnc (EulerOS-SA-2021-1127)	Nessus	Huawei Local Security Checks	1/20/2021	1/29/2024	high
133201	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0159-1)	Nessus	SuSE Local Security Checks	1/23/2020	3/29/2024	high
133395	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0266-1)	Nessus	SuSE Local Security Checks	1/31/2020	3/28/2024	high
139988	EulerOS 2.0 SP8 : tigervnc (EulerOS-SA-2020-1885)	Nessus	Huawei Local Security Checks	8/28/2020	2/22/2024	high
141653	Scientific Linux Security Update : tigervnc on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	10/21/2020	2/14/2024	high
141215	Oracle Linux 7 : tigervnc (ELSA-2020-3875)	Nessus	Oracle Linux Local Security Checks	10/7/2020	2/16/2024	high
141028	RHEL 7 : tigervnc (RHSA-2020:3875)	Nessus	Red Hat Local Security Checks	9/29/2020	2/16/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high

high