Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7225: An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets. 1546858: CVE-2018-7225 libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libvncserver | 0:0.9.9-12.amzn2 |
| Amazon Linux · 2 | libvncserver-debuginfo | 0:0.9.9-12.amzn2 |
| Amazon Linux · 2 | libvncserver-devel | 0:0.9.9-12.amzn2 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitiz…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-7225.html