Lucene search

K
slackwareSlackware Linux ProjectSSA-2024-021-01
HistoryJan 21, 2024 - 8:53 p.m.

[slackware-security] tigervnc

2024-01-2120:53:54
Slackware Linux Project
www.slackware.com
9
slackware
tigervnc
security fixes
package upgrade
x86_64
-current
installation
ftp hosting
cve-2023-6377
cve-2023-6478
cve-2023-6816
cve-2024-0229
cve-2024-0408
cve-2024-0409
cve-2024-21885
cve-2024-21886
osu open source lab

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.273 Low

EPSS

Percentile

96.8%

New tigervnc packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:

extra/tigervnc/tigervnc-1.12.0-i586-5_slack15.0.txz: Rebuilt.
Recompiled against xorg-server-1.20.14, including the latest patches for
several security issues. Thanks to marav.
For more information, see:
https://vulners.com/cve/CVE-2023-6377
https://vulners.com/cve/CVE-2023-6478
https://vulners.com/cve/CVE-2023-6816
https://vulners.com/cve/CVE-2024-0229
https://vulners.com/cve/CVE-2024-0408
https://vulners.com/cve/CVE-2024-0409
https://vulners.com/cve/CVE-2024-21885
https://vulners.com/cve/CVE-2024-21886
https://vulners.com/cve/CVE-2024-21886
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/extra/tigervnc/tigervnc-1.12.0-i586-5_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/extra/tigervnc/tigervnc-1.12.0-x86_64-5_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/extra/tigervnc/tigervnc-1.13.1-i586-3.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/extra/tigervnc/tigervnc-1.13.1-x86_64-3.txz

MD5 signatures:

Slackware 15.0 package:
13a4377260bd096461166e37ca16afe7 tigervnc-1.12.0-i586-5_slack15.0.txz

Slackware x86_64 15.0 package:
a942377a4d2c2b4b80a556eb81e5d97f tigervnc-1.12.0-x86_64-5_slack15.0.txz

Slackware -current package:
2716715cb2d3d87c4eeb0141d2e1b7ae tigervnc-1.13.1-i586-3.txz

Slackware x86_64 -current package:
2cd2eb06417478d62768c6f0a67f9550 tigervnc-1.13.1-x86_64-3.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg tigervnc-1.12.0-i586-5_slack15.0.txz

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.273 Low

EPSS

Percentile

96.8%