Moderate: libvncserver security update
Summary
ALSA-2021:1811: Moderate: libvncserver security update. Affects libvncserver versions < 0.9.11-17.el8. Fixed in 0.9.11-17.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibVNCServer is a C library that enables the implementation of VNC server functionality into own programs. It provides the necessary tools and functions to create and manage VNC servers. The library is widely used in various applications and systems that require remote desktop access. However, several security vulnerabilities have been identified in the libvncserver library.
Vulnerability Detail
The libvncserver library is affected by multiple security vulnerabilities:
- CVE-2018-21247: Uninitialized memory contents are vulnerable to Information Leak.
- CVE-2019-20839: Buffer overflow in ConnectClientToUnixSock().
- CVE-2020-14397: NULL pointer dereference in libvncserver/rfbregion.c.
- CVE-2020-14405: TextChat size is not limited in libvncclient/rfbproto.c.
- CVE-2020-25708: Divide by zero in libvncserver/rfbserver.c, leading to a potential denial-of-service (DoS) attack.
These vulnerabilities can have various impacts, including information leakage, remote code execution, and denial-of-service attacks. Attackers may exploit these vulnerabilities to gain unauthorized access, manipulate data, or disrupt the availability of VNC servers.
How To Fix
Minimum fixed version
0.9.11-17.el8
This is the first release that contains the fix.
sudo dnf update libvncserverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. However, users can mitigate the risk by ensuring that their VNC servers are not exposed to untrusted networks or unauthorized users. Implementing proper network segmentation, access controls, and monitoring can help reduce the attack surface and detect any potential exploitation attempts.
Conclusion
The libvncserver library is affected by multiple security vulnerabilities that can have significant impacts on the security and stability of VNC server implementations. It is crucial for users to update their libvncserver package to the latest version and implement necessary security measures to protect their VNC servers. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvncserver →
FAQ
LibVNCServer is a C library that enables the implementation of VNC server functionality into own programs. It provides the necessary tools and functions to create and manage VNC servers.
These vulnerabilities can lead to information leakage, remote code execution, and denial-of-service attacks. Attackers may exploit these vulnerabilities to gain unauthorized access, manipulate data, or disrupt the availability of VNC servers.
To fix these vulnerabilities, it is recommended to update the libvncserver package to version 0.9.11-17.el8 or later. This update includes patches and fixes for the identified security issues.
There are no specific workarounds mentioned for these vulnerabilities. However, users can mitigate the risk by ensuring that their VNC servers are not exposed to untrusted networks or unauthorized users.
To protect VNC servers, it is recommended to implement proper network segmentation, access controls, and monitoring. This can help reduce the attack surface and detect any potential exploitation attempts.
Related vulnerabilities
Recent vulnerabilities recorded for libvncserver.
