|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2018-20748: LibVNCServer: libvnc contains multiple heap out-of-bounds writes | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Alexandros Toptsoglou <atoptsoglou> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P3 - Medium | CC: | smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/223984/ | ||
| Whiteboard: | CVSSv3:SUSE:CVE-2018-20748:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv2:NVD:CVE-2018-20748:7.5:(AV:N/AC:L/Au:N/C:P/I:P/A:P) CVSSv3:NVD:CVE-2018-20748:9.8:(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSSv3:RedHat:CVE-2018-20019:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv3:RedHat:CVE-2018-20748:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Alexandros Toptsoglou
2019-01-31 10:15:41 UTC
The patch for CVE-2018-20019 did not completely fix the issue. Thus a new CVE was created and more fixes[1][2][3][4] became available which when applied deal with the issue completely. All of our codestreams had received the patch for CVE-2018-20019 and also all of them are affected. [1]https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a [2]https://github.com/LibVNC/libvncserver/commit/e34bcbb759ca5bef85809967a268fdf214c1ad2c [3]https://github.com/LibVNC/libvncserver/commit/c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7 [4]https://github.com/LibVNC/libvncserver/commit/a64c3b37af9a6c8f8009d7516874b8d266b42bae 0.9.12 submitted into develproject. Packages submitted into 15,12,11/LibVNCServer. I believe all fixed. SUSE-SU-2019:0283-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: SUSE Linux Enterprise Workstation Extension 15 (src): LibVNCServer-0.9.10-4.6.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src): LibVNCServer-0.9.10-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): LibVNCServer-0.9.10-4.6.1 SUSE-SU-2019:0313-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: SUSE OpenStack Cloud 7 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-SP4 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-SP3 (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): LibVNCServer-0.9.9-17.11.1 SUSE Linux Enterprise Server 12-LTSS (src): LibVNCServer-0.9.9-17.11.1 SUSE Enterprise Storage 4 (src): LibVNCServer-0.9.9-17.11.1 SUSE-SU-2019:13952-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): LibVNCServer-0.9.1-160.9.1 SUSE Linux Enterprise Server 11-SP4 (src): LibVNCServer-0.9.1-160.9.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): LibVNCServer-0.9.1-160.9.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): LibVNCServer-0.9.1-160.9.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): LibVNCServer-0.9.1-160.9.1 openSUSE-SU-2019:0196-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: openSUSE Leap 15.0 (src): LibVNCServer-0.9.10-lp150.3.6.1 openSUSE-SU-2019:0200-1: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: openSUSE Leap 42.3 (src): LibVNCServer-0.9.9-16.9.1 done SUSE-SU-2019:0313-2: An update that fixes three vulnerabilities is now available. Category: security (critical) Bug References: 1123823,1123828,1123832 CVE References: CVE-2018-20748,CVE-2018-20749,CVE-2018-20750 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): LibVNCServer-0.9.9-17.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. This is an autogenerated message for OBS integration: This bug (1123823) was mentioned in https://build.opensuse.org/request/show/919689 Factory / LibVNCServer |