Security update for tightvnc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14235-1 Final 1 1 2019-11-29T13:46:58Z current 2019-11-29T13:46:58Z 2019-11-29T13:46:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tightvnc This update for tightvnc fixes the following issues: - CVE-2019-15679: Fixed a heap buffer overflow in InitialiseRFBConnection which might lead to code execution (bsc#1155476). - CVE-2019-8287: Fixed a global buffer overflow in HandleCoRREBBPmay which might lead to code execution (bsc#1155472). - CVE-2019-15680: Fixed a null pointer dereference in HandleZlibBPP which could have led to denial of service (bsc#1155452). - CVE-2019-15678: Fixed a heap buffer overflow in rfbServerCutText handler (bsc#1155442). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-tightvnc-14235,slessp4-tightvnc-14235 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914235-1/ Link for SUSE-SU-2019:14235-1 https://lists.suse.com/pipermail/sle-security-updates/2019-November/006203.html E-Mail link for SUSE-SU-2019:14235-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155442 SUSE Bug 1155442 https://bugzilla.suse.com/1155452 SUSE Bug 1155452 https://bugzilla.suse.com/1155472 SUSE Bug 1155472 https://bugzilla.suse.com/1155476 SUSE Bug 1155476 https://www.suse.com/security/cve/CVE-2019-15678/ SUSE CVE CVE-2019-15678 page https://www.suse.com/security/cve/CVE-2019-15679/ SUSE CVE CVE-2019-15679 page https://www.suse.com/security/cve/CVE-2019-15680/ SUSE CVE CVE-2019-15680 page https://www.suse.com/security/cve/CVE-2019-8287/ SUSE CVE CVE-2019-8287 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS tightvnc-1.3.9-81.15.3.1 tightvnc-1.3.9-81.15.3.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 tightvnc-1.3.9-81.15.3.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity. CVE-2019-15678 SUSE Linux Enterprise Point of Sale 11 SP3:tightvnc-1.3.9-81.15.3.1 SUSE Linux Enterprise Server 11 SP4-LTSS:tightvnc-1.3.9-81.15.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914235-1/ https://www.suse.com/security/cve/CVE-2019-15678.html CVE-2019-15678 https://bugzilla.suse.com/1155442 SUSE Bug 1155442 TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity. CVE-2019-15679 SUSE Linux Enterprise Point of Sale 11 SP3:tightvnc-1.3.9-81.15.3.1 SUSE Linux Enterprise Server 11 SP4-LTSS:tightvnc-1.3.9-81.15.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914235-1/ https://www.suse.com/security/cve/CVE-2019-15679.html CVE-2019-15679 https://bugzilla.suse.com/1155476 SUSE Bug 1155476 TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity. CVE-2019-15680 SUSE Linux Enterprise Point of Sale 11 SP3:tightvnc-1.3.9-81.15.3.1 SUSE Linux Enterprise Server 11 SP4-LTSS:tightvnc-1.3.9-81.15.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914235-1/ https://www.suse.com/security/cve/CVE-2019-15680.html CVE-2019-15680 https://bugzilla.suse.com/1155442 SUSE Bug 1155442 https://bugzilla.suse.com/1155452 SUSE Bug 1155452 TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity. CVE-2019-8287 SUSE Linux Enterprise Point of Sale 11 SP3:tightvnc-1.3.9-81.15.3.1 SUSE Linux Enterprise Server 11 SP4-LTSS:tightvnc-1.3.9-81.15.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914235-1/ https://www.suse.com/security/cve/CVE-2019-8287.html CVE-2019-8287 https://bugzilla.suse.com/1155472 SUSE Bug 1155472