USN-3171-1 — libvncserver vulnerabilities

Summary

Josef Gajdusek discovered that the LibVNCServer client library incorrectly
handled certain FrameBufferUpdate messages. If a user were tricked into
connecting to a malicious server, an attacker could use this issue to cause
a denial of service, or possibly execute arbitrary code. (CVE-2016-9941,
CVE-2016-9942)

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	libvncserver	0.9.9+dfsg-1ubuntu1.2
Ubuntu · 16.04 LTS 16.04:LTS	libvncserver	0.9.10+dfsg-3ubuntu0.16.04.1

Vulnerabilities 2

Unscored —

CVE-2016-9941

Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a…

libvncserver libvncserver italc libvncserver Debian Ubuntu Alpine

Dec 31, 2016
Unscored —

CVE-2016-9942

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a de…

libvncserver libvncserver italc libvncserver Debian Ubuntu Alpine

Dec 31, 2016

References

report
https://ubuntu.com/security/CVE-2016-9941
report
https://ubuntu.com/security/CVE-2016-9942

libvncserver vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 2

Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a…

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a de…

References