According to the versions of the libvncserve packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in LibVNCServer before 0.9.13.
    There is an information leak (of uninitialized memory     contents) in the libvncclient/rfbproto.c     ConnectToRFBRepeater function.(CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13     has a buffer overflow via a long socket     filename.(CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13.
    An improperly closed TCP connection causes an infinite     loop in libvncclient/sockets.c.(CVE-2020-14398)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint32_t pointers     in libvncclient/rfbproto.c.(CVE-2020-14399)

  - An issue was discovered in LibVNCServer before 0.9.13.
    Byte-aligned data is accessed through uint16_t pointers     in libvncserver/translate.c.(CVE-2020-14400)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/scale.c has a pixel_value integer     overflow.(CVE-2020-14401)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/hextile.c allows out-of-bounds access via     encodings.(CVE-2020-14403)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/rre.c allows out-of-bounds access via     encodings.(CVE-2020-14404)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNCServer makes writing a VNC server (or more     correctly, a program exporting a frame-buffer via the     Remote Frame Buffer protocol) easy. It hides the     programmer from the tedious task of managing clients     and compression schemata.Security Fix(es):An issue was     discovered in LibVNCServer before 0.9.13. There is an     information leak (of uninitialized memory contents) in     the libvncclient/rfbproto.c ConnectToRFBRepeater     function.(CVE-2018-21247)libvncclient/sockets.c in     LibVNCServer before 0.9.13 has a buffer overflow via a     long socket filename.(CVE-2019-20839)An issue was     discovered in LibVNCServer before 0.9.13.
    libvncserver/rfbregion.c has a NULL pointer     dereference.(CVE-2020-14397)An issue was discovered in     LibVNCServer before 0.9.13. An improperly closed TCP     connection causes an infinite loop in     libvncclient/sockets.c.(CVE-2020-14398)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint32_t pointers in     libvncclient/rfbproto.c. NOTE: there is reportedly 'no     trust boundary crossed.'(CVE-2020-14399)An issue was     discovered in LibVNCServer before 0.9.13. Byte-aligned     data is accessed through uint16_t pointers in     libvncserver/translate.c. NOTE: Third parties do not     consider this to be a vulnerability as there is no     known path of exploitation or cross of a trust     boundary.(CVE-2020-14400)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/scale.c has a     pixel_value integer overflow.(CVE-2020-14401)An issue     was discovered in LibVNCServer before 0.9.13.
    libvncserver/corre.c allows out-of-bounds access via     encodings.(CVE-2020-14402)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/hextile.c     allows out-of-bounds access via     encodings.(CVE-2020-14403)An issue was discovered in     LibVNCServer before 0.9.13. libvncserver/rre.c allows     out-of-bounds access via encodings.(CVE-2020-14404)An     issue was discovered in LibVNCServer before 0.9.13.
    libvncclient/rfbproto.c does not limit TextChat     size.(CVE-2020-14405)libvncclient/cursor.c in     LibVNCServer through 0.9.12 has a HandleCursorShape     integer overflow and heap-based buffer overflow via a     large height or width value. (CVE-2019-20788)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in libVNC (libvncserver Debian package), an implemenantation of the VNC server and client protocol.

CVE-2019-20839

libvncclient/sockets.c in LibVNCServer had a buffer overflow via a long socket filename.

CVE-2020-14397

libvncserver/rfbregion.c had a NULL pointer dereference.

CVE-2020-14399

Byte-aligned data was accessed through uint32_t pointers in libvncclient/rfbproto.c.

CVE-2020-14400

Byte-aligned data was accessed through uint16_t pointers in libvncserver/translate.c.

CVE-2020-14401

libvncserver/scale.c had a pixel_value integer overflow.

CVE-2020-14402

libvncserver/corre.c allowed out-of-bounds access via encodings.

CVE-2020-14403

libvncserver/hextile.c allowed out-of-bounds access via encodings.

CVE-2020-14404

libvncserver/rre.c allowed out-of-bounds access via encodings.

CVE-2020-14405

libvncclient/rfbproto.c does not limit TextChat size.

For Debian 8 'Jessie', these problems have been fixed in version 0.9.9+dfsg2-6.1+deb8u8.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream bugfix and security release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream bugfix/security release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

  - security update

  - added patches fix CVE-2018-21247 [bsc#1173874],     uninitialized memory contents are vulnerable to     Information leak

  + LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839     [bsc#1173875], buffer overflow in     ConnectClientToUnixSock()

  + LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840     [bsc#1173876], unaligned accesses in hybiReadAndDecode     can lead to denial of service

  + LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398     [bsc#1173880], improperly closed TCP connection causes     an infinite loop in libvncclient/sockets.c

  + LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397     [bsc#1173700], NULL pointer dereference in     libvncserver/rfbregion.c

  + LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399     [bsc#1173743], Byte-aligned data is accessed through     uint32_t pointers in libvncclient/rfbproto.c.

  + LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400     [bsc#1173691], Byte-aligned data is accessed through     uint16_t pointers in libvncserver/translate.c.

  + LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401     [bsc#1173694], potential integer overflows in     libvncserver/scale.c

  + LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402     [bsc#1173701], out-of-bounds access via encodings.

  + LibVNCServer-CVE-2020-14402,14403,14404.patch fix     CVE-2017-18922 [bsc#1173477], preauth buffer overwrite

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
140161	EulerOS 2.0 SP5 : libvncserve (EulerOS-SA-2020-1940)	Nessus	Huawei Local Security Checks	9/2/2020	5/12/2022	high
140883	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2020-2116)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	critical
137907	Debian DLA-2264-1 : libvncserver security update	Nessus	Debian Local Security Checks	7/1/2020	3/5/2024	medium
138476	Fedora 31 : libvncserver (2020-37112ac660)	Nessus	Fedora Local Security Checks	7/15/2020	3/1/2024	critical
138530	Fedora 32 : libvncserver (2020-1a4b1c8271)	Nessus	Fedora Local Security Checks	7/16/2020	3/1/2024	critical
138828	openSUSE Security Update : LibVNCServer (openSUSE-2020-1025)	Nessus	SuSE Local Security Checks	7/22/2020	2/29/2024	critical

Detections

Analytics

Plugins Search

high

critical

medium

critical

critical

critical