Security update for LibVNCServer (important)

An update that fixes 10 vulnerabilities is now available.

Description:

This update for LibVNCServer fixes the following issues:

• security update
• added patches fix CVE-2018-21247 [bsc#1173874], uninitialized memory
  contents are vulnerable to Information leak
  • LibVNCServer-CVE-2018-21247.patch fix CVE-2019-20839 [bsc#1173875],
    buffer overflow in ConnectClientToUnixSock()
  • LibVNCServer-CVE-2019-20839.patch fix CVE-2019-20840 [bsc#1173876],
    unaligned accesses in hybiReadAndDecode can lead to denial of service
  • LibVNCServer-CVE-2019-20840.patch fix CVE-2020-14398 [bsc#1173880],
    improperly closed TCP connection causes an infinite loop in
    libvncclient/sockets.c
  • LibVNCServer-CVE-2020-14398.patch fix CVE-2020-14397 [bsc#1173700],
    NULL pointer dereference in libvncserver/rfbregion.c
  • LibVNCServer-CVE-2020-14397.patch fix CVE-2020-14399 [bsc#1173743],
    Byte-aligned data is accessed through uint32_t pointers in
    libvncclient/rfbproto.c.
  • LibVNCServer-CVE-2020-14399.patch fix CVE-2020-14400 [bsc#1173691],
    Byte-aligned data is accessed through uint16_t pointers in
    libvncserver/translate.c.
  • LibVNCServer-CVE-2020-14400.patch fix CVE-2020-14401 [bsc#1173694],
    potential integer overflows in libvncserver/scale.c
  • LibVNCServer-CVE-2020-14401.patch fix CVE-2020-14402 [bsc#1173701],
    out-of-bounds access via encodings.
  • LibVNCServer-CVE-2020-14402,14403,14404.patch fix CVE-2017-18922
    [bsc#1173477], preauth buffer overwrite

This update was imported from the SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.2:

  zypper in -t patch openSUSE-2020-1056=1