Security update for LibVNCServer SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:2110-1 Final 1 1 2015-11-26T10:47:31Z current 2015-11-26T10:47:31Z 2015-11-26T10:47:31Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for LibVNCServer The libvncserver package was updated to fix the following security issues: - bsc#897031: fix several security issues: * CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side. * CVE-2014-6052: Lack of malloc() return value checking on client side. * CVE-2014-6053: Server crash on a very large ClientCutText message. * CVE-2014-6054: Server crash when scaling factor is set to zero. * CVE-2014-6055: Multiple stack overflows in File Transfer feature. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-libvncserver-12227,sdksp4-libvncserver-12227,sledsp3-libvncserver-12227,sledsp4-libvncserver-12227,slessp3-libvncserver-12227,slessp4-libvncserver-12227 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ Link for SUSE-SU-2015:2110-1 https://lists.suse.com/pipermail/sle-security-updates/2015-November/001701.html E-Mail link for SUSE-SU-2015:2110-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/897031 SUSE Bug 897031 https://www.suse.com/security/cve/CVE-2014-6051/ SUSE CVE CVE-2014-6051 page https://www.suse.com/security/cve/CVE-2014-6052/ SUSE CVE CVE-2014-6052 page https://www.suse.com/security/cve/CVE-2014-6053/ SUSE CVE CVE-2014-6053 page https://www.suse.com/security/cve/CVE-2014-6054/ SUSE CVE CVE-2014-6054 page https://www.suse.com/security/cve/CVE-2014-6055/ SUSE CVE CVE-2014-6055 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 LibVNCServer-devel-0.9.1-156.1 LibVNCServer-0.9.1-156.1 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Server 11 SP3 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Server 11 SP4 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 LibVNCServer-0.9.1-156.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 LibVNCServer-devel-0.9.1-156.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 LibVNCServer-devel-0.9.1-156.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow. CVE-2014-6051 SUSE Linux Enterprise Desktop 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Desktop 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP3:LibVNCServer-devel-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-156.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ https://www.suse.com/security/cve/CVE-2014-6051.html CVE-2014-6051 https://bugzilla.suse.com/897031 SUSE Bug 897031 https://bugzilla.suse.com/900896 SUSE Bug 900896 The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message. CVE-2014-6052 SUSE Linux Enterprise Desktop 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Desktop 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP3:LibVNCServer-devel-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-156.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ https://www.suse.com/security/cve/CVE-2014-6052.html CVE-2014-6052 https://bugzilla.suse.com/897031 SUSE Bug 897031 The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc. CVE-2014-6053 SUSE Linux Enterprise Desktop 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Desktop 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP3:LibVNCServer-devel-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-156.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ https://www.suse.com/security/cve/CVE-2014-6053.html CVE-2014-6053 https://bugzilla.suse.com/897031 SUSE Bug 897031 The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message. CVE-2014-6054 SUSE Linux Enterprise Desktop 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Desktop 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP3:LibVNCServer-devel-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-156.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ https://www.suse.com/security/cve/CVE-2014-6054.html CVE-2014-6054 https://bugzilla.suse.com/897031 SUSE Bug 897031 Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message. CVE-2014-6055 SUSE Linux Enterprise Desktop 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Desktop 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP3:LibVNCServer-devel-0.9.1-156.1 SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-156.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/ https://www.suse.com/security/cve/CVE-2014-6055.html CVE-2014-6055 https://bugzilla.suse.com/897031 SUSE Bug 897031