libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14355-1 advisory.

  - LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC     server code, which allow an attacker to read stack memory and can be abused for information disclosure.
    Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack     appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0920 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in     HandleCursorShape function (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0920 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in     HandleCursorShape function (CVE-2019-20788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNCServer makes writing a VNC server (or more     correctly, a program exporting a frame-buffer via the     Remote Frame Buffer protocol) easy. It hides the     programmer from the tedious task of managing clients     and compression schemata.Security Fix(es):An issue was     discovered in LibVNCServer before 0.9.13. There is an     information leak (of uninitialized memory contents) in     the libvncclient/rfbproto.c ConnectToRFBRepeater     function.(CVE-2018-21247)libvncclient/sockets.c in     LibVNCServer before 0.9.13 has a buffer overflow via a     long socket filename.(CVE-2019-20839)An issue was     discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)An issue was discovered in     LibVNCServer before 0.9.13. An improperly closed TCP     connection causes an infinite loop in     libvncclient/sockets.c.(CVE-2020-14398)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint32_t pointers in     libvncclient/rfbproto.c. NOTE: there is reportedly 'no     trust boundary crossed.'(CVE-2020-14399)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint16_t pointers in     libvncserver/translate.c. NOTE: Third parties do not     consider this to be a vulnerability as there is no     known path of exploitation or cross of a trust     boundary.(CVE-2020-14400)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/scale.c has a     pixel_value integer overflow.(CVE-2020-14401)An issue     was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/hextile.c     allows out-of-bounds access via     encodings.(CVE-2020-14403)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/rre.c allows     out-of-bounds access via encodings.(CVE-2020-14404)An     issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)libvncclient/cursor.c in     LibVNCServer through 0.9.12 has a HandleCursorShape     integer overflow and heap-based buffer overflow via a     large height or width value. (CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libvncclient/cursor.c in LibVNCServer through 0.9.12     has a HandleCursorShape integer overflow and heap-based     buffer overflow via a large height or width value.
    NOTE: this may overlap CVE-2019-15690.(CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNC commit before     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a     memory leak (CWE-655) in VNC server code, which allow     an attacker to read stack memory and can be abused for     information disclosure. Combined with another     vulnerability, it can be used to leak stack memory and     bypass ASLR. This attack appear to be exploitable via     network connectivity. These vulnerabilities have been     fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.(CVE-2019-1568     1)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12     has a HandleCursorShape integer overflow and heap-based     buffer overflow via a large height or width value.
    NOTE: this may overlap CVE-2019-15690.(CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).

CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).

CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibVNCServer incorrectly handled decompressing data. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680) It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.
(CVE-2019-15681) It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15690, CVE-2019-20788) It was discovered that LibVNCServer incorrectly handled decoding WebSocket frames. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2017-18922).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

  - CVE-2019-15690: Fixed a heap buffer overflow     (bsc#1160471).

  - CVE-2019-15681: Fixed a memory leak which could have     allowed to a remote attacker to read stack memory     (bsc#1155419).

  - CVE-2019-20788: Fixed a integer overflow and heap-based     buffer overflow via a large height or width value     (bsc#1170441).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0913 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in     HandleCursorShape function (CVE-2019-20788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
150539	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2020:14355-1)	Nessus	SuSE Local Security Checks	critical
145958	CentOS 8 : libvncserver (CESA-2020:0920)	Nessus	CentOS Local Security Checks	critical
143980	NewStart CGSL CORE 5.05 / MAIN 5.05 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0087)	Nessus	NewStart CGSL Local Security Checks	critical
143006	RHEL 8 : libvncserver (RHSA-2020:0920)	Nessus	Red Hat Local Security Checks	critical
140883	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2020-2116)	Nessus	Huawei Local Security Checks	critical
140281	NewStart CGSL CORE 5.04 / MAIN 5.04 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0038)	Nessus	NewStart CGSL Local Security Checks	critical
140146	EulerOS 2.0 SP5 : libvncserver (EulerOS-SA-2020-1925)	Nessus	Huawei Local Security Checks	critical
139969	EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2020-1866)	Nessus	Huawei Local Security Checks	critical
138259	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-2)	Nessus	SuSE Local Security Checks	critical
138132	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer vulnerabilities (USN-4407-1)	Nessus	Ubuntu Local Security Checks	critical
137525	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2020-1683)	Nessus	Huawei Local Security Checks	critical
136453	openSUSE Security Update : LibVNCServer (openSUSE-2020-624)	Nessus	SuSE Local Security Checks	critical
136396	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:1165-1)	Nessus	SuSE Local Security Checks	critical
136395	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-1)	Nessus	SuSE Local Security Checks	critical
134861	RHEL 7 : libvncserver (RHSA-2020:0913)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-20788

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical