Summary
It was discovered that LibVNCServer incorrectly handled decompressing data. An
attacker could possibly use this issue to cause LibVNCServer to crash,
resulting in a denial of service. (CVE-2019-15680)
It was discovered that an information disclosure vulnerability existed in
LibVNCServer when sending a ServerCutText message. An attacker could possibly
use this issue to expose sensitive information. This issue only affected
Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)
It was discovered that LibVNCServer incorrectly handled cursor shape updates.
If a user were tricked in to connecting to a malicious server, an attacker
could possibly use this issue to cause LibVNCServer to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.
(CVE-2019-15690, CVE-2019-20788)
It was discovered that LibVNCServer incorrectly handled decoding WebSocket
frames. An attacker could possibly use this issue to cause LibVNCServer to
crash, resulting in a denial of service, or possibly execute arbitrary code.
This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.
(CVE-2017-18922)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | libvncserver | 0.9.10+dfsg-3ubuntu0.16.04.4 |
| Ubuntu · 18.04 LTS 18.04:LTS | libvncserver | 0.9.11+dfsg-1ubuntu1.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | libvncserver | 0.9.12+dfsg-9ubuntu0.1 |
Vulnerabilities 5
-
High 8.8
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() func…
-
Unscored —
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A…
-
Unscored —
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of Syste…
-
Unscored —
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, whic…
-
Unscored —
libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer ove…