[SECURITY] [DLA 2347-1] libvncserver security update

Debian LTS Advisory DLA-2347-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 28, 2020 https://wiki.debian.org/LTS Package : libvncserver Version : 0.9.11+dfsg-1.3deb9u5 CVE ID : CVE-2019-20839 CVE-2020-14397 CVE-2020-14399 CVE-2020-14400 CVE-2020-14401...

GHSA-49RV-G7W5-M8XX Cross-Site Scripting in @novnc/novnc

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting XSS. The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects...

Cross-Site Scripting in @novnc/novnc

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting XSS. The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects...

Important: libvncserver security update

LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Security Fixes: libvncserver: websocket decoding buffer overflow CVE-2017-18922 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

novnc: XSS vulnerability via the messages propagated to the status field

An XSS vulnerability was discovered in noVNC in which arbitrary HTML could be injected into the noVNC web page. An attacker having access to a VNC server could use target host values in a crafted URL to gain access to secure information such as VM tokens...

Important: Red Hat Security Advisory: libvncserver security update

An update for libvncserver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

SUSE SLES12 Security Update : xrdp (SUSE-SU-2020:1943-1)

This update for xrdp provides the following fix : CVE-2020-4044: xrdp-sesman can be crashed remotely over port 3350 bsc1173580. Fixed an issue where xrdp-sesman could not restart bsc1155952. Fixed an issue where xrdp could not start due to an error in the service file use absolute path in ExecSta...

SUSE-SU-2020:1943-1 Security update for xrdp

This update for xrdp provides the following fix: - CVE-2020-4044: xrdp-sesman can be crashed remotely over port 3350 bsc1173580. - Fixed an issue where xrdp-sesman could not restart bsc1155952. - Fixed an issue where xrdp could not start due to an error in the service file use absolute path in...

[SECURITY] Fedora 32 Update: libvncserver-0.9.13-2.fc32

LibVNCServer makes writing a VNC server or more correctly, a program expor ting a frame-buffer via the Remote Frame Buffer protocol easy. It hides the programmer from the tedious task of managing clients and compression schemata...

Fedora: Security Advisory for remmina (FEDORA-2020-dd8c133829)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the component libvncserver/hextile.c in the cross-platform library LibVNCServer allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the libvncserver/hextile.c component of the cross-platform library LibVNCServer arises from an operation that occurs outside the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility...

PT-2020-15421 · Jenkins · Jenkins Vncviewer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VncViewer Plugin versions 1.7 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the checkVncServ form validation endpoint does not properly escape a parameter value,...

RHEL 8 : virt:rhel (RHSA-2020:2774)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2774 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contai...

LibVNCServer Information Disclosure Vulnerability

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in programs. A security vulnerability exists in the 'ConnectToRFBRepeater' function in the libvncclient/rfbproto.c file in versions of LibVNCServer prior to...

LibVNCServer Buffer Overflow Vulnerability (CNVD-2020-36780)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in programs. A buffer overflow vulnerability exists in the libvncclient/sockets.c file in versions of LibVNCServer prior to 0.9.13. A remote attacker could...

UBUNTU-CVE-2020-14399

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed...

UBUNTU-CVE-2020-14398

An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c...

SUSE SLES12 Security Update : qemu (SUSE-SU-2020:1501-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2020-1983: Fixed a use-after-free in the ipreass function of slirp bsc1170940. CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect bsc1165776. CVE-2020-1711: Fixed a potential OOB access in the...

ssvnc: Multiple vulnerabilities

Background The Enhanced TightVNC Viewer, SSVNC, adds encryption security to VNC connections. Description Multiple vulnerabilities have been discovered in ssvnc. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Websites Conducting Port Scans

Security researcher Charlie Belmer is reporting that commercial websites such as eBay are conducting port scans of their visitors. Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites. I...