Summary
[1.8.0-21]
- Add upstream patch needed because of previous security fixes
Resolves: bz#1826822
[1.8.0-20]
- Fix stack buffer overflow in CMsgReader::readSetCursor
Resolves: bz#1791773
- Fix heap buffer overflow in DecodeManager::decodeRect
Resolves: bz#1791768
- Fix heap buffer overflow in TightDecoder::FilterGradient
Resolves: bz#1791763
- Fix heap-based buffer overflow triggered from CopyRectDecoder
Resolves: bz#1791747
- Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
Resolves: bz#1791759
- Add option to fallback to empty port when the specified one is taken
Resolves: bz#1791996
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | tigervnc | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-icons | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-license | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-server | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-server-applet | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-server-minimal | 0:1.8.0-21.el7 |
| Oracle Linux · 7 | tigervnc-server-module | 0:1.8.0-21.el7 |
Vulnerabilities 5
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack …
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectD…
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. E…
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::de…
-
Unscored —
TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::read…