[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#943793: marked as done (libvncserver: CVE-2019-15681)

Your message dated Sat, 21 Dec 2019 19:02:33 +0000
with message-id <E1iik1J-00095r-8v@fasolo.debian.org>
and subject line Bug#943793: fixed in libvncserver 0.9.11+dfsg-1.3~deb9u2
has caused the Debian Bug report #943793,
regarding libvncserver: CVE-2019-15681
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
943793: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=943793
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: libvncserver
Version: 0.9.11+dfsg-1.3
Severity: grave
Tags: security upstream
Control: found -1 0.9.11+dfsg-1.3~deb9u1

Hi,

The following vulnerability was published for libvncserver, severity
is choosen to be rather on safe side and issue has not been fully
checked/investigated for impact/attack vector.

CVE-2019-15681[0]:
| LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains
| a memory leak (CWE-655) in VNC server code, which allow an attacker to
| read stack memory and can be abused for information disclosure.
| Combined with another vulnerability, it can be used to leak stack
| memory and bypass ASLR. This attack appear to be exploitable via
| network connectivity. These vulnerabilities have been fixed in commit
| d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-15681
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15681

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: libvncserver
Source-Version: 0.9.11+dfsg-1.3~deb9u2

We believe that the bug you reported is fixed in the latest version of
libvncserver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 943793@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated libvncserver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 16 Dec 2019 11:08:42 +0100
Source: libvncserver
Architecture: source
Version: 0.9.11+dfsg-1.3~deb9u2
Distribution: stretch
Urgency: medium
Maintainer: Peter Spiess-Knafl <dev@spiessknafl.at>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 880531 905786 943793
Changes:
 libvncserver (0.9.11+dfsg-1.3~deb9u2) stretch; urgency=medium
 .
   * CVE-2019-15681:
     + rfbserver: don't leak stack memory to the remote. (Closes: #943793).
   * debian/patches:
     + Trivial patch rebasing.
     + Add 3 use-after-free patches. Resolve a freeze during connection
       closure and a segmentation fault on multi-threaded VNC servers. (Closes:
       #905786).
     + Add 0002-set-true-color-flag-to-1.patch. Fix connecting to VMware servers.
       (Closes: #880531).
Checksums-Sha1:
 743692ad8dc1a4a4569f447a02b719174e016aa6 2463 libvncserver_0.9.11+dfsg-1.3~deb9u2.dsc
 9ff36c8dcf566f4badde6e3d199a74a723e384dd 22652 libvncserver_0.9.11+dfsg-1.3~deb9u2.debian.tar.xz
 dcbb4a90bfdea47044ae972040874f98f939e20f 7212 libvncserver_0.9.11+dfsg-1.3~deb9u2_source.buildinfo
Checksums-Sha256:
 eb6e0ecbceb91e96c02422a0d937b9a1b0bfa2d1ec36b3e01d60e43ebfcd70d7 2463 libvncserver_0.9.11+dfsg-1.3~deb9u2.dsc
 b600e935b5a25b52192407e03fc91e4aa667fc10e2cf0ef99684c3d5c88dbd89 22652 libvncserver_0.9.11+dfsg-1.3~deb9u2.debian.tar.xz
 5d54792938c6709e41acb1096a8332990927fde7b382fe4f5eae380b2246aa36 7212 libvncserver_0.9.11+dfsg-1.3~deb9u2_source.buildinfo
Files:
 43ca10dc7baef25e62dc2f0e4fe2dc9d 2463 libs optional libvncserver_0.9.11+dfsg-1.3~deb9u2.dsc
 06d5745952a59ee91d7521e8c2d6a6ca 22652 libs optional libvncserver_0.9.11+dfsg-1.3~deb9u2.debian.tar.xz
 560f77c1a3749fe1e646aa05439ab8f0 7212 libs optional libvncserver_0.9.11+dfsg-1.3~deb9u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAl33WOkVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxohsP/1wxOd3RifEBFy6rBGESi5qmNAGT
+3FuX98idptSXQQIlAGckbChKWFKbcaQRtfS2RkTjhGYWiGs/AE5qwC170v26OrA
1W0kf2Rm1k9OxWLec309b0wg81GCLTUcKamSfGXotjTk2lUYw0Rd7B0CLHxgvuPe
fBsydEHVnkw5U8lYzX2tUfEJQTRHnI2yICFOUjEAGuB0Dv3Rkm2/IjLxH57rOrcH
GP5Iu4cJmmWyhUBkLy6v/x5KWV8WmWe6Ux6Hyo9uKVyuNUDm5oJOwGCqmij0aV2w
P7mbhf9BJmvLc2wX97hC+S3uNJI/xdbfH4vKwFWvQlcRjZ/af2ObkQbxKZ/4mEGK
4eGWoykBRndqiL4WMFgmvsV46cx95Xw4NZu9O7N5IiKBiLQxDLgeugOoDlcn+cLH
KEe7gjbdxRhil86m+w/YsSeLkbVGsFsmHkve36jDAmIHQvuvAopb2VQ6b5JLF8jF
MZGIloMmDHEfNdjy8WO2c7l9ZWJejeFQ72t+y43fzlUdEVLY/5bmSSi0VOgsacIh
AZzh7anL2DT/D8mU7VbCkhV9obGbNIKhERVOeXCgBaMU9L05RBEPtijL9f/kFVGH
pfrv9/m5ZpxGZseicpa2o3TW8qyLRis/eHgOKT3h+DHMwBX/vxur5lESoSUOxhXO
2wA1K03rSKIxwWQG
=6oiL
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: