Summary
It was discovered that an information disclosure vulnerability existed in the
LibVNCServer vendored in iTALC when sending a ServerCutText message. An
attacker could possibly use this issue to expose sensitive information.
(CVE-2019-15681)
It was discovered that the LibVNCServer and LibVNCClient vendored in iTALC
incorrectly handled certain packet lengths. A remote attacker could possibly
use this issue to obtain sensitive information, cause a denial of service, or
execute arbitrary code.
(CVE-2018-15127 CVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022,
CVE-2018-20023, CVE-2018-20024, CVE-2018-20748, CVE-2018-20749, CVE-2018-20750,
CVE-2018-7225, CVE-2019-15681)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | italc | 1:3.0.3+dfsg1-3ubuntu0.1 |
Vulnerabilities 12
-
Unscored —CVE-2018-15127 EPSS 15%
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server …
-
Unscored —
LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities…
-
Unscored —
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside str…
-
Unscored —
LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC cl…
-
Unscored —
LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vu…
-
Unscored —
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC R…
-
Unscored —
LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that…
-
Unscored —
LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for…
-
Unscored —
LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-201…
-
Unscored —
LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-20…
-
Unscored —
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitiz…
-
Unscored —
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, whic…
References
-
report
https://ubuntu.com/security/CVE-2018-7225
-
report
https://ubuntu.com/security/CVE-2018-15127
-
report
https://ubuntu.com/security/CVE-2018-20019
-
report
https://ubuntu.com/security/CVE-2018-20020
-
report
https://ubuntu.com/security/CVE-2018-20021
-
report
https://ubuntu.com/security/CVE-2018-20022
-
report
https://ubuntu.com/security/CVE-2018-20023
-
report
https://ubuntu.com/security/CVE-2018-20024
-
report
https://ubuntu.com/security/CVE-2018-20748
-
report
https://ubuntu.com/security/CVE-2018-20749
-
report
https://ubuntu.com/security/CVE-2018-20750
-
report
https://ubuntu.com/security/CVE-2019-15681