tigervnc security update

2024-04-2400:00:00

linux.oracle.com

tigervnc

security update

cve-2024-31083

heap buffer overread

data leakage

user-after-free

heap buffer overflow

out-of-bounds memory access

xorg-x11-server

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

[1.13.1-2.10]

Fix crash caused by fix for CVE-2024-31083
Resolves: RHEL-30981
[1.13.1-2.9]
Rebuild (z-stream target)
Resolves: RHEL-31011
Resolves: RHEL-30981
Resolves: RHEL-30998
[1.13.1-2.8]
Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
Resolves: RHEL-31011
Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
Resolves: RHEL-30981
Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
Resolves: RHEL-30998
[1.13.1-3.7]
Fix use after free related to CVE-2024-21886
Resolves: RHEL-20432
Fix copy/paste error in the DeviceStateNotify
Resolves: RHEL-20583
[1.13.1-3.6]
Don’t try to get pointer position when the pointer becomes a floating device
Resolves: RHEL-20432
[1.13.1-3.5]
Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
Resolves: RHEL-20432
Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
Resolves: RHEL-20420
Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
Resolves: RHEL-20583
Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
Resolves: RHEL-21252
[1.13.1-2.4]
Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
Resolves: RHEL-18409
[1.13.1-2.3]
Rebuild (selinux-policy)
Resolves: RHEL-18409
Resolves: RHEL-18421
[1.13.1-2.2]
Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
Resolves: RHEL-18409
Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
Resolves: RHEL-18421
[1.13.1-2.1]
Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
Resolves: RHEL-15229

OSVersionArchitecturePackageVersionFilename
oracle linux8srctigervnc< 1.13.1-2.el8_9.10tigervnc-1.13.1-2.el8_9.10.src.rpm
oracle linux8aarch64tigervnc< 1.13.1-2.el8_9.10tigervnc-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux8noarchtigervnc-icons< 1.13.1-2.el8_9.10tigervnc-icons-1.13.1-2.el8_9.10.noarch.rpm
oracle linux8noarchtigervnc-license< 1.13.1-2.el8_9.10tigervnc-license-1.13.1-2.el8_9.10.noarch.rpm
oracle linux8noarchtigervnc-selinux< 1.13.1-2.el8_9.10tigervnc-selinux-1.13.1-2.el8_9.10.noarch.rpm
oracle linux8aarch64tigervnc-server< 1.13.1-2.el8_9.10tigervnc-server-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux8aarch64tigervnc-server-minimal< 1.13.1-2.el8_9.10tigervnc-server-minimal-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux8aarch64tigervnc-server-module< 1.13.1-2.el8_9.10tigervnc-server-module-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux8srctigervnc< 1.13.1-2.el8_9.10tigervnc-1.13.1-2.el8_9.10.src.rpm
oracle linux8x86_64tigervnc< 1.13.1-2.el8_9.10tigervnc-1.13.1-2.el8_9.10.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	tigervnc	< 1.13.1-2.el8_9.10	tigervnc-1.13.1-2.el8_9.10.src.rpm
oracle linux	8	aarch64	tigervnc	< 1.13.1-2.el8_9.10	tigervnc-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux	8	noarch	tigervnc-icons	< 1.13.1-2.el8_9.10	tigervnc-icons-1.13.1-2.el8_9.10.noarch.rpm
oracle linux	8	noarch	tigervnc-license	< 1.13.1-2.el8_9.10	tigervnc-license-1.13.1-2.el8_9.10.noarch.rpm
oracle linux	8	noarch	tigervnc-selinux	< 1.13.1-2.el8_9.10	tigervnc-selinux-1.13.1-2.el8_9.10.noarch.rpm
oracle linux	8	aarch64	tigervnc-server	< 1.13.1-2.el8_9.10	tigervnc-server-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux	8	aarch64	tigervnc-server-minimal	< 1.13.1-2.el8_9.10	tigervnc-server-minimal-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux	8	aarch64	tigervnc-server-module	< 1.13.1-2.el8_9.10	tigervnc-server-module-1.13.1-2.el8_9.10.aarch64.rpm
oracle linux	8	src	tigervnc	< 1.13.1-2.el8_9.10	tigervnc-1.13.1-2.el8_9.10.src.rpm
oracle linux	8	x86_64	tigervnc	< 1.13.1-2.el8_9.10	tigervnc-1.13.1-2.el8_9.10.x86_64.rpm