Vulnerability in libvncserver - security update
Summary
DLA-1332-1: libvncserver - security update. Affects libvncserver versions < 0.9.9+dfsg-1+deb7u3. Fixed in 0.9.9+dfsg-1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvncserver is a library that provides a VNC server functionality, allowing remote desktop access to graphical desktop environments. It is widely used in various applications and systems. However, versions up to 0.9.11 of libvncserver suffer from a security vulnerability. The issue lies in the improper sanitization of the 'msg.cct.length' parameter, which can lead to uninitialized and potentially sensitive data access or other impacts, such as integer overflow, through specially crafted VNC packets.
Vulnerability Detail
The vulnerability in libvncserver arises from the lack of proper sanitization of the 'msg.cct.length' parameter. This can allow an attacker to exploit the vulnerability by sending specially crafted VNC packets. The consequences of this vulnerability include potential access to uninitialized and sensitive data, as well as the possibility of unspecified other impacts, such as integer overflow. The impact of the vulnerability may vary depending on the specific usage of the library.
How To Fix
Minimum fixed version
0.9.9+dfsg-1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvncserverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the libvncserver library versions up to 0.9.11 are vulnerable to a security issue that can lead to unauthorized access to sensitive data or other impacts. Users are advised to upgrade their libvncserver packages to version 0.9.9+dfsg-1+deb7u3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvncserver →
FAQ
libvncserver is a library that provides VNC server functionality, allowing remote desktop access to graphical desktop environments.
Versions up to 0.9.11 of libvncserver are affected by this vulnerability.
The impact of this vulnerability includes potential access to uninitialized and sensitive data, as well as the possibility of unspecified other impacts, such as integer overflow.
To fix this vulnerability, it is recommended to upgrade the libvncserver package to version 0.9.9+dfsg-1+deb7u3 or later.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libvncserver.
