Security update for vino SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0955-1 Final 1 1 2020-04-08T10:27:12Z current 2020-04-08T10:27:12Z 2020-04-08T10:27:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for vino This update for vino fixes the following issues: - CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-955,SUSE-SLE-SERVER-12-SP4-2020-955,SUSE-SLE-SERVER-12-SP5-2020-955 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200955-1/ Link for SUSE-SU-2020:0955-1 https://lists.suse.com/pipermail/sle-security-updates/2020-April/006688.html E-Mail link for SUSE-SU-2020:0955-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155419 SUSE Bug 1155419 https://www.suse.com/security/cve/CVE-2019-15681/ SUSE CVE CVE-2019-15681 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 vino-3.20.2-7.3.21 vino-lang-3.20.2-7.3.21 vino-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server 12 SP4 vino-lang-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server 12 SP4 vino-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server 12 SP5 vino-lang-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server 12 SP5 vino-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 vino-lang-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 vino-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 vino-lang-3.20.2-7.3.21 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. CVE-2019-15681 SUSE Linux Enterprise Server 12 SP4:vino-3.20.2-7.3.21 SUSE Linux Enterprise Server 12 SP4:vino-lang-3.20.2-7.3.21 SUSE Linux Enterprise Server 12 SP5:vino-3.20.2-7.3.21 SUSE Linux Enterprise Server 12 SP5:vino-lang-3.20.2-7.3.21 SUSE Linux Enterprise Server for SAP Applications 12 SP4:vino-3.20.2-7.3.21 SUSE Linux Enterprise Server for SAP Applications 12 SP4:vino-lang-3.20.2-7.3.21 SUSE Linux Enterprise Server for SAP Applications 12 SP5:vino-3.20.2-7.3.21 SUSE Linux Enterprise Server for SAP Applications 12 SP5:vino-lang-3.20.2-7.3.21 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200955-1/ https://www.suse.com/security/cve/CVE-2019-15681.html CVE-2019-15681 https://bugzilla.suse.com/1155419 SUSE Bug 1155419